@azure/msal-browser 2.17.0 → 2.21.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.17.0 2021-09-08 */
+/*! @azure/msal-browser v2.21.0 2022-01-04 */
 'use strict';
 'use strict';
 
@@ -105,7 +105,7 @@ function __spread() {
     return ar;
 }
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*! *****************************************************************************
 Copyright (c) Microsoft Corporation.
 
@@ -192,7 +192,7 @@ function __spreadArrays() {
     return r;
 }
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -257,6 +257,8 @@ var HeaderNames;
     HeaderNames["CONTENT_TYPE"] = "Content-Type";
     HeaderNames["RETRY_AFTER"] = "Retry-After";
     HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
+    HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
+    HeaderNames["AuthenticationInfo"] = "Authentication-Info";
 })(HeaderNames || (HeaderNames = {}));
 /**
  * Persistent cache keys MSAL which stay while user is logged in.
@@ -327,6 +329,7 @@ var AADServerParamKeys;
     AADServerParamKeys["ON_BEHALF_OF"] = "on_behalf_of";
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
+    AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
  * Claims request keys
@@ -484,8 +487,9 @@ var SERVER_TELEM_CONSTANTS = {
  */
 exports.AuthenticationScheme = void 0;
 (function (AuthenticationScheme) {
-    AuthenticationScheme["POP"] = "pop";
     AuthenticationScheme["BEARER"] = "Bearer";
+    AuthenticationScheme["POP"] = "pop";
+    AuthenticationScheme["SSH"] = "ssh-cert";
 })(exports.AuthenticationScheme || (exports.AuthenticationScheme = {}));
 /**
  * Constants related to throttling
@@ -550,7 +554,7 @@ var CacheOutcome;
     CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
 })(CacheOutcome || (CacheOutcome = {}));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -594,7 +598,7 @@ var AuthError = /** @class */ (function (_super) {
     return AuthError;
 }(Error));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -657,10 +661,19 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
                 throw AuthError.createUnexpectedError(notImplErr);
             });
         });
+    },
+    hashString: function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var notImplErr;
+            return __generator(this, function (_a) {
+                notImplErr = "Crypto interface - hashString() has not been implemented";
+                throw AuthError.createUnexpectedError(notImplErr);
+            });
+        });
     }
 };
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -846,6 +859,10 @@ var ClientAuthErrorMessage = {
     bindingKeyNotRemovedError: {
         code: "binding_key_not_removed",
         desc: "Could not remove the credential's binding key from storage."
+    },
+    logoutNotSupported: {
+        code: "end_session_endpoint_not_supported",
+        desc: "Provided authority does not support logout."
     }
 };
 /**
@@ -945,12 +962,6 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createNonceNotFoundError = function (missingNonce) {
         return new ClientAuthError(ClientAuthErrorMessage.nonceNotFoundError.code, ClientAuthErrorMessage.nonceNotFoundError.desc + ":  " + missingNonce);
     };
-    /**
-     * Creates an error thrown when the authorization code required for a token request is null or empty.
-     */
-    ClientAuthError.createNoTokensFoundError = function () {
-        return new ClientAuthError(ClientAuthErrorMessage.noTokensFoundError.code, ClientAuthErrorMessage.noTokensFoundError.desc);
-    };
     /**
      * Throws error when multiple tokens are in cache.
      */
@@ -1115,10 +1126,16 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createBindingKeyNotRemovedError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.bindingKeyNotRemovedError.code, ClientAuthErrorMessage.bindingKeyNotRemovedError.desc);
     };
+    /**
+     * Thrown when logout is attempted for an authority that doesnt have an end_session_endpoint
+     */
+    ClientAuthError.createLogoutNotSupportedError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
+    };
     return ClientAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1243,7 +1260,7 @@ var StringUtils = /** @class */ (function () {
     return StringUtils;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1423,12 +1440,12 @@ var Logger = /** @class */ (function () {
     return Logger;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /* eslint-disable header/header */
 var name$1 = "@azure/msal-common";
-var version$1 = "5.0.0";
+var version$1 = "6.0.0";
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1439,7 +1456,7 @@ var version$1 = "5.0.0";
  *
  * Key:Value Schema:
  *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme>
+ * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
  *
  * Value Schema:
  * {
@@ -1453,6 +1470,7 @@ var version$1 = "5.0.0";
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
  *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+ *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -1480,7 +1498,7 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      */
     CredentialEntity.prototype.generateCredentialKey = function () {
-        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType);
+        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
     };
     /**
      * returns the type of the cache (in this case credential)
@@ -1524,16 +1542,14 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
      */
-    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType) {
+    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
         var credentialKey = [
             this.generateAccountIdForCacheKey(homeAccountId, environment),
             this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-            this.generateTargetForCacheKey(target)
+            this.generateTargetForCacheKey(target),
+            this.generateClaimsHashForCacheKey(requestedClaimsHash),
+            this.generateSchemeForCacheKey(tokenType)
         ];
-        // PoP Tokens include scheme in cache key
-        if (tokenType === exports.AuthenticationScheme.POP) {
-            credentialKey.push(tokenType.toLowerCase());
-        }
         return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
@@ -1569,10 +1585,26 @@ var CredentialEntity = /** @class */ (function () {
     CredentialEntity.generateTargetForCacheKey = function (scopes) {
         return (scopes || "").toLowerCase();
     };
+    /**
+     * Generate requested claims key component as per schema: <requestedClaims>
+     */
+    CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+        return (requestedClaimsHash || "").toLowerCase();
+    };
+    /**
+     * Generate scheme key componenet as per schema: <scheme>
+     */
+    CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+        /*
+         * PoP Tokens and SSH certs include scheme in cache key
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : "";
+    };
     return CredentialEntity;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1644,15 +1676,31 @@ var ClientConfigurationErrorMessage = {
     },
     invalidCloudDiscoveryMetadata: {
         code: "invalid_cloud_discovery_metadata",
-        desc: "Invalid cloudDiscoveryMetadata provided. Must be a JSON object containing tenant_discovery_endpoint and metadata fields"
+        desc: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields"
     },
     invalidAuthorityMetadata: {
         code: "invalid_authority_metadata",
-        desc: "Invalid authorityMetadata provided. Must by a JSON object containing authorization_endpoint, token_endpoint, end_session_endpoint, issuer fields."
+        desc: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields."
     },
     untrustedAuthority: {
         code: "untrusted_authority",
         desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter."
+    },
+    missingSshJwk: {
+        code: "missing_ssh_jwk",
+        desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme."
+    },
+    missingSshKid: {
+        code: "missing_ssh_kid",
+        desc: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme."
+    },
+    missingNonceAuthenticationHeader: {
+        code: "missing_nonce_authentication_header",
+        desc: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce."
+    },
+    invalidAuthenticationHeader: {
+        code: "invalid_authentication_header",
+        desc: "Invalid authentication header provided"
     }
 };
 /**
@@ -1774,10 +1822,34 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     ClientConfigurationError.createUntrustedAuthorityError = function () {
         return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
     };
+    /*
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
+     */
+    ClientConfigurationError.createMissingSshJwkError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshJwk.code, ClientConfigurationErrorMessage.missingSshJwk.desc);
+    };
+    /**
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key ID is omitted from the request
+     */
+    ClientConfigurationError.createMissingSshKidError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshKid.code, ClientConfigurationErrorMessage.missingSshKid.desc);
+    };
+    /**
+     * Throws error when provided headers don't contain a header that a server nonce can be extracted from
+     */
+    ClientConfigurationError.createMissingNonceAuthenticationHeadersError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.code, ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.desc);
+    };
+    /**
+     * Throws error when a provided header is invalid in any way
+     */
+    ClientConfigurationError.createInvalidAuthenticationHeaderError = function (invalidHeaderName, details) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc + ". Invalid header: " + invalidHeaderName + ". Details: " + details);
+    };
     return ClientConfigurationError;
 }(ClientAuthError));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1961,7 +2033,7 @@ var ScopeSet = /** @class */ (function () {
     return ScopeSet;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1999,7 +2071,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2013,7 +2085,7 @@ var AuthorityType;
     AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
 })(AuthorityType || (AuthorityType = {}));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2247,7 +2319,7 @@ var AccountEntity = /** @class */ (function () {
     return AccountEntity;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2285,7 +2357,7 @@ var AuthToken = /** @class */ (function () {
     return AuthToken;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2375,7 +2447,8 @@ var CacheManager = /** @class */ (function () {
                             environment: credential.environment,
                             homeAccountId: credential.homeAccountId,
                             realm: credential.realm,
-                            tokenType: credential.tokenType
+                            tokenType: credential.tokenType,
+                            requestedClaimsHash: credential.requestedClaimsHash
                         });
                         currentScopes = ScopeSet.fromString(credential.target);
                         currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
@@ -2447,7 +2520,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2460,7 +2533,7 @@ var CacheManager = /** @class */ (function () {
      * @param oboAssertion
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2507,27 +2580,37 @@ var CacheManager = /** @class */ (function () {
             if (!!target && !_this.matchTarget(entity, target)) {
                 return;
             }
+            // If request OR cached entity has requested Claims Hash, check if they match
+            if (requestedClaimsHash || entity.requestedClaimsHash) {
+                // Don't match if either is undefined or they are different
+                if (entity.requestedClaimsHash !== requestedClaimsHash) {
+                    return;
+                }
+            }
+            // Access Token with Auth Scheme specific matching
             if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
                 if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
                     return;
                 }
-                // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
-                if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
-                    // AccessToken_With_AuthScheme that doesn't have pop in the key is outdated
-                    _this.removeItem(cacheKey, CacheSchemaType.CREDENTIAL);
-                    return;
+                // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                if (tokenType === exports.AuthenticationScheme.SSH) {
+                    if (keyId && !_this.matchKeyId(entity, keyId)) {
+                        return;
+                    }
                 }
             }
+            // At this point, the entity matches the request, update cache key if key schema has changed
+            var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
             switch (credType) {
                 case CredentialType.ID_TOKEN:
-                    matchingCredentials.idTokens[cacheKey] = entity;
+                    matchingCredentials.idTokens[updatedCacheKey] = entity;
                     break;
                 case CredentialType.ACCESS_TOKEN:
                 case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                    matchingCredentials.accessTokens[cacheKey] = entity;
+                    matchingCredentials.accessTokens[updatedCacheKey] = entity;
                     break;
                 case CredentialType.REFRESH_TOKEN:
-                    matchingCredentials.refreshTokens[cacheKey] = entity;
+                    matchingCredentials.refreshTokens[updatedCacheKey] = entity;
                     break;
             }
         });
@@ -2686,6 +2769,7 @@ var CacheManager = /** @class */ (function () {
                     case 0:
                         key = credential.generateCredentialKey();
                         if (!(credential.credentialType.toLowerCase() === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
+                        if (!(credential.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 4];
                         accessTokenWithAuthSchemeEntity = credential;
                         kid = accessTokenWithAuthSchemeEntity.keyId;
                         if (!kid) return [3 /*break*/, 4];
@@ -2725,10 +2809,10 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param authScheme
      */
-    CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme) {
+    CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
         var cachedAccount = this.readAccountFromCache(account);
         var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme);
+        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
         var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
         var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
         if (cachedAccount && cachedIdToken) {
@@ -2782,9 +2866,14 @@ var CacheManager = /** @class */ (function () {
      * @param scopes
      * @param authScheme
      */
-    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme) {
-        // Distinguish between Bearer and PoP token cache types
-        var credentialType = (authScheme === exports.AuthenticationScheme.POP) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
+    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
+        var scopes = new ScopeSet(request.scopes || []);
+        var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+        /*
+         * Distinguish between Bearer and PoP/SSH token cache types
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
         var accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -2792,7 +2881,9 @@ var CacheManager = /** @class */ (function () {
             clientId: clientId,
             realm: account.tenantId,
             target: scopes.printScopesLowerCase(),
-            tokenType: authScheme
+            tokenType: authScheme,
+            keyId: request.sshKid,
+            requestedClaimsHash: request.requestedClaimsHash
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2945,6 +3036,14 @@ var CacheManager = /** @class */ (function () {
     CacheManager.prototype.matchTokenType = function (entity, tokenType) {
         return !!(entity.tokenType && entity.tokenType === tokenType);
     };
+    /**
+     * Returns true if the credential's keyId matches the one in the request, false otherwise
+     * @param entity
+     * @param tokenType
+     */
+    CacheManager.prototype.matchKeyId = function (entity, keyId) {
+        return !!(entity.keyId && entity.keyId === keyId);
+    };
     /**
      * returns if a given cache entity is of the type appmetadata
      * @param key
@@ -3093,10 +3192,14 @@ var DefaultStorageClass = /** @class */ (function (_super) {
             });
         });
     };
+    DefaultStorageClass.prototype.updateCredentialCacheKey = function () {
+        var notImplErr = "Storage interface - updateCredentialCacheKey() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
     return DefaultStorageClass;
 }(CacheManager));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3178,7 +3281,7 @@ function buildAuthOptions(authOptions) {
     return __assign({ clientCapabilities: [] }, authOptions);
 }
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3198,7 +3301,7 @@ var ServerError = /** @class */ (function (_super) {
     return ServerError;
 }(AuthError));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3281,10 +3384,12 @@ var ThrottlingUtils = /** @class */ (function () {
             authority: request.authority,
             scopes: request.scopes,
             homeAccountIdentifier: homeAccountIdentifier,
+            claims: request.claims,
             authenticationScheme: request.authenticationScheme,
             resourceRequestMethod: request.resourceRequestMethod,
             resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims
+            shrClaims: request.shrClaims,
+            sshKid: request.sshKid
         };
         var key = this.generateThrottlingStorageKey(thumbprint);
         return cacheManager.removeItem(key, CacheSchemaType.THROTTLING);
@@ -3292,7 +3397,7 @@ var ThrottlingUtils = /** @class */ (function () {
     return ThrottlingUtils;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3341,7 +3446,7 @@ var NetworkManager = /** @class */ (function () {
     return NetworkManager;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3352,7 +3457,7 @@ var CcsCredentialType;
     CcsCredentialType["UPN"] = "UPN";
 })(CcsCredentialType || (CcsCredentialType = {}));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3441,7 +3546,7 @@ var BaseClient = /** @class */ (function () {
     return BaseClient;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3527,7 +3632,7 @@ var RequestValidator = /** @class */ (function () {
     return RequestValidator;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3831,6 +3936,15 @@ var RequestParameterBuilder = /** @class */ (function () {
             this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
         }
     };
+    /**
+     * add SSH JWK and key ID to query params
+     */
+    RequestParameterBuilder.prototype.addSshJwk = function (sshJwkString) {
+        if (!StringUtils.isEmpty(sshJwkString)) {
+            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.SSH);
+            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
+        }
+    };
     /**
      * add server telemetry fields
      * @param serverTelemetryManager
@@ -3858,7 +3972,7 @@ var RequestParameterBuilder = /** @class */ (function () {
     return RequestParameterBuilder;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3923,7 +4037,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
     return IdTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3973,7 +4087,7 @@ var TimeUtils = /** @class */ (function () {
     return TimeUtils;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4019,8 +4133,8 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion) {
-        var _a;
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+        var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
         atEntity.credentialType = CredentialType.ACCESS_TOKEN;
@@ -4042,15 +4156,28 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.target = scopes;
         atEntity.oboAssertion = oboAssertion;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-        // Create Access Token With AuthScheme instead of regular access token
-        if (atEntity.tokenType === exports.AuthenticationScheme.POP) {
+        if (requestedClaims) {
+            atEntity.requestedClaims = requestedClaims;
+            atEntity.requestedClaimsHash = requestedClaimsHash;
+        }
+        /*
+         * Create Access Token With Auth Scheme instead of regular access token
+         * Cast to lower to handle "bearer" from ADFS
+         */
+        if (((_a = atEntity.tokenType) === null || _a === void 0 ? void 0 : _a.toLowerCase()) !== exports.AuthenticationScheme.BEARER.toLowerCase()) {
             atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-            // Make sure keyId is present and add it to credential
-            var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-            if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                throw ClientAuthError.createTokenClaimsRequiredError();
+            switch (atEntity.tokenType) {
+                case exports.AuthenticationScheme.POP:
+                    // Make sure keyId is present and add it to credential
+                    var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
+                    if (!((_b = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _b === void 0 ? void 0 : _b.kid)) {
+                        throw ClientAuthError.createTokenClaimsRequiredError();
+                    }
+                    atEntity.keyId = tokenClaims.cnf.kid;
+                    break;
+                case exports.AuthenticationScheme.SSH:
+                    atEntity.keyId = keyId;
             }
-            atEntity.keyId = tokenClaims.cnf.kid;
         }
         return atEntity;
     };
@@ -4074,7 +4201,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
     return AccessTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4141,16 +4268,16 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
     return RefreshTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 /**
- * InteractionRequiredAuthErrorMessage class containing string constants used by error codes and messages.
+ * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
  */
-var InteractionRequiredAuthErrorMessage = [
+var InteractionRequiredServerErrorMessage = [
     "interaction_required",
     "consent_required",
     "login_required"
@@ -4163,7 +4290,16 @@ var InteractionRequiredAuthSubErrorMessage = [
     "consent_required"
 ];
 /**
- * Error thrown when user interaction is required at the auth server.
+ * Interaction required errors defined by the SDK
+ */
+var InteractionRequiredAuthErrorMessage = {
+    noTokensFoundError: {
+        code: "no_tokens_found",
+        desc: "No refresh token found in the cache. Please sign-in."
+    }
+};
+/**
+ * Error thrown when user interaction is required.
  */
 var InteractionRequiredAuthError = /** @class */ (function (_super) {
     __extends(InteractionRequiredAuthError, _super);
@@ -4173,18 +4309,30 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
         Object.setPrototypeOf(_this, InteractionRequiredAuthError.prototype);
         return _this;
     }
+    /**
+     * Helper function used to determine if an error thrown by the server requires interaction to resolve
+     * @param errorCode
+     * @param errorString
+     * @param subError
+     */
     InteractionRequiredAuthError.isInteractionRequiredError = function (errorCode, errorString, subError) {
-        var isInteractionRequiredErrorCode = !!errorCode && InteractionRequiredAuthErrorMessage.indexOf(errorCode) > -1;
+        var isInteractionRequiredErrorCode = !!errorCode && InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
         var isInteractionRequiredSubError = !!subError && InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-        var isInteractionRequiredErrorDesc = !!errorString && InteractionRequiredAuthErrorMessage.some(function (irErrorCode) {
+        var isInteractionRequiredErrorDesc = !!errorString && InteractionRequiredServerErrorMessage.some(function (irErrorCode) {
             return errorString.indexOf(irErrorCode) > -1;
         });
         return isInteractionRequiredErrorCode || isInteractionRequiredErrorDesc || isInteractionRequiredSubError;
     };
+    /**
+     * Creates an error thrown when the authorization code required for a token request is null or empty.
+     */
+    InteractionRequiredAuthError.createNoTokensFoundError = function () {
+        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.noTokensFoundError.code, InteractionRequiredAuthErrorMessage.noTokensFoundError.desc);
+    };
     return InteractionRequiredAuthError;
-}(ServerError));
+}(AuthError));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4200,7 +4348,7 @@ var CacheRecord = /** @class */ (function () {
     return CacheRecord;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4271,7 +4419,7 @@ var ProtocolUtils = /** @class */ (function () {
     return ProtocolUtils;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4472,7 +4620,7 @@ var UrlString = /** @class */ (function () {
     return UrlString;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4531,14 +4679,14 @@ var PopTokenGenerator = /** @class */ (function () {
     };
     PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
-            var resourceRequestMethod, resourceRequestUri, shrClaims, resourceUrlString, resourceUrlComponents;
+            var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims;
+                        resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -4547,7 +4695,7 @@ var PopTokenGenerator = /** @class */ (function () {
     return PopTokenGenerator;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4617,7 +4765,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return AppMetadataEntity;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4653,7 +4801,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return TokenCacheContext;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4734,7 +4882,9 @@ var ResponseHandler = /** @class */ (function () {
                         if (!!authCodePayload && !!authCodePayload.state) {
                             requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);
                         }
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
+                        // Add keyId from request to serverTokenResponse if defined
+                        serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -4771,7 +4921,7 @@ var ResponseHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 7;
                     case 7: return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
                 }
             });
         });
@@ -4782,7 +4932,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, idTokenObj, requestScopes, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4798,7 +4948,7 @@ var ResponseHandler = /** @class */ (function () {
         var cachedAccessToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
             // If scopes not returned in server response, use request scopes
-            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);
+            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
             /*
              * Use timestamp calculated before request
              * Server may return timestamps as strings, parse to numbers if so.
@@ -4810,7 +4960,7 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
@@ -4857,7 +5007,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param fromTokenCache
      * @param stateString
      */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState) {
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
             var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
@@ -4906,7 +5056,8 @@ var ResponseHandler = /** @class */ (function () {
                                 tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
-                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING
+                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
+                                code: code
                             }];
                 }
             });
@@ -4915,7 +5066,7 @@ var ResponseHandler = /** @class */ (function () {
     return ResponseHandler;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4927,7 +5078,10 @@ var ResponseHandler = /** @class */ (function () {
 var AuthorizationCodeClient = /** @class */ (function (_super) {
     __extends(AuthorizationCodeClient, _super);
     function AuthorizationCodeClient(configuration) {
-        return _super.call(this, configuration) || this;
+        var _this = _super.call(this, configuration) || this;
+        // Flag to indicate if client is for hybrid spa auth code redemption
+        _this.includeRedirectUri = true;
+        return _this;
     }
     /**
      * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -5027,10 +5181,12 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
-                            shrClaims: request.shrClaims
+                            shrClaims: request.shrClaims,
+                            sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.createTokenRequestBody(request)];
                     case 1:
@@ -5074,13 +5230,24 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
-                        // validate the redirectUri (to be a non null value)
-                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        /*
+                         * For hybrid spa flow, there will be a code but no verifier
+                         * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
+                         */
+                        if (!this.includeRedirectUri) {
+                            // Just validate
+                            RequestValidator.validateRedirectUri(request.redirectUri);
+                        }
+                        else {
+                            // Validate and include redirect uri
+                            parameterBuilder.addRedirectUri(request.redirectUri);
+                        }
                         // Add scope array, parameter builder will add default scopes and dedupe
                         parameterBuilder.addScopes(request.scopes);
                         // add code: user set, not validated
@@ -5109,10 +5276,20 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _a.sent();
+                        cnfString = _b.sent();
                         parameterBuilder.addPopToken(cnfString);
-                        _a.label = 2;
+                        return [3 /*break*/, 3];
                     case 2:
+                        if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                            if (request.sshJwk) {
+                                parameterBuilder.addSshJwk(request.sshJwk);
+                            }
+                            else {
+                                throw ClientConfigurationError.createMissingSshJwkError();
+                            }
+                        }
+                        _b.label = 3;
+                    case 3:
                         correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                         parameterBuilder.addCorrelationId(correlationId);
                         if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
@@ -5151,6 +5328,15 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                     break;
                             }
                         }
+                        if (request.tokenBodyParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+                        }
+                        // Add hybrid spa parameters if not already provided
+                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                            parameterBuilder.addExtraQueryParameters((_a = {},
+                                _a[AADServerParamKeys.RETURN_SPA_CODE] = "1",
+                                _a));
+                        }
                         return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
             });
@@ -5288,7 +5474,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     return AuthorizationCodeClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5342,7 +5528,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         return [2 /*return*/, this.acquireTokenWithCachedRefreshToken(request, true)];
                     }
                     catch (e) {
-                        noFamilyRTInCache = e instanceof ClientAuthError && e.errorCode === ClientAuthErrorMessage.noTokensFoundError.code;
+                        noFamilyRTInCache = e instanceof InteractionRequiredAuthError && e.errorCode === InteractionRequiredAuthErrorMessage.noTokensFoundError.code;
                         clientMismatchErrorWithFamilyRT = e instanceof ServerError && e.errorCode === Errors.INVALID_GRANT_ERROR && e.subError === Errors.CLIENT_MISMATCH_ERROR;
                         // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
                         if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
@@ -5370,7 +5556,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                 refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
                 // no refresh Token
                 if (!refreshToken) {
-                    throw ClientAuthError.createNoTokensFoundError();
+                    throw InteractionRequiredAuthError.createNoTokensFoundError();
                 }
                 refreshTokenRequest = __assign(__assign({}, request), { refreshToken: refreshToken.secret, authenticationScheme: request.authenticationScheme || exports.AuthenticationScheme.BEARER, ccsCredential: {
                         credential: request.account.homeAccountId,
@@ -5399,10 +5585,12 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
-                            shrClaims: request.shrClaims
+                            shrClaims: request.shrClaims,
+                            sshKid: request.sshKid
                         };
                         endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
                         return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)];
@@ -5427,9 +5615,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      */
     RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, _a, _b, clientInfo;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
+            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
@@ -5454,12 +5642,22 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         }
                         if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                        _b = (_a = parameterBuilder).addPopToken;
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        _b.apply(_a, [_c.sent()]);
-                        _c.label = 2;
+                        cnfString = _a.sent();
+                        parameterBuilder.addPopToken(cnfString);
+                        return [3 /*break*/, 3];
                     case 2:
+                        if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                            if (request.sshJwk) {
+                                parameterBuilder.addSshJwk(request.sshJwk);
+                            }
+                            else {
+                                throw ClientConfigurationError.createMissingSshJwkError();
+                            }
+                        }
+                        _a.label = 3;
+                    case 3:
                         if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
                             parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
                         }
@@ -5487,7 +5685,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
     return RefreshTokenClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5533,7 +5731,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     SilentFlowClient.prototype.acquireCachedToken = function (request) {
         var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
-            var requestScopes, environment, authScheme, cacheRecord;
+            var environment, cacheRecord;
             return __generator(this, function (_e) {
                 switch (_e.label) {
                     case 0:
@@ -5541,37 +5739,35 @@ var SilentFlowClient = /** @class */ (function (_super) {
                         if (!request) {
                             throw ClientConfigurationError.createEmptyTokenRequestError();
                         }
-                        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
-                        if (!request.account) {
-                            throw ClientAuthError.createNoAccountInSilentRequestError();
-                        }
-                        requestScopes = new ScopeSet(request.scopes || []);
-                        environment = request.authority || this.authority.getPreferredCache();
-                        authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme);
                         if (request.forceRefresh) {
                             // Must refresh due to present force_refresh flag.
                             (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
-                        else if (!cacheRecord.accessToken) {
+                        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+                        if (!request.account) {
+                            throw ClientAuthError.createNoAccountInSilentRequestError();
+                        }
+                        environment = request.authority || this.authority.getPreferredCache();
+                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
+                        if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
                             (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
                             TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
                             // Must refresh due to expired access_token.
                             (_c = this.serverTelemetryManager) === null || _c === void 0 ? void 0 : _c.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (cacheRecord.accessToken.refreshOn && TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
                             // Must refresh due to the refresh_in value.
                             (_d = this.serverTelemetryManager) === null || _d === void 0 ? void 0 : _d.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
-                        else if (!StringUtils.isEmptyObj(request.claims)) {
-                            // Must refresh due to request parameters.
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         if (this.config.serverTelemetryManager) {
@@ -5605,7 +5801,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     return SilentFlowClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5613,11 +5809,10 @@ var SilentFlowClient = /** @class */ (function (_super) {
 function isOpenIdConfigResponse(response) {
     return (response.hasOwnProperty("authorization_endpoint") &&
         response.hasOwnProperty("token_endpoint") &&
-        response.hasOwnProperty("end_session_endpoint") &&
         response.hasOwnProperty("issuer"));
 }
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5631,7 +5826,7 @@ exports.ProtocolMode = void 0;
     ProtocolMode["OIDC"] = "OIDC";
 })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5698,7 +5893,6 @@ var AuthorityMetadataEntity = /** @class */ (function () {
             entity.hasOwnProperty("canonical_authority") &&
             entity.hasOwnProperty("authorization_endpoint") &&
             entity.hasOwnProperty("token_endpoint") &&
-            entity.hasOwnProperty("end_session_endpoint") &&
             entity.hasOwnProperty("issuer") &&
             entity.hasOwnProperty("aliasesFromNetwork") &&
             entity.hasOwnProperty("endpointsFromNetwork") &&
@@ -5707,7 +5901,7 @@ var AuthorityMetadataEntity = /** @class */ (function () {
     return AuthorityMetadataEntity;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5717,7 +5911,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5831,7 +6025,7 @@ var RegionDiscovery = /** @class */ (function () {
     return RegionDiscovery;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5985,6 +6179,10 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
+                // ROPC policies may not have end_session_endpoint set
+                if (!this.metadata.end_session_endpoint) {
+                    throw ClientAuthError.createLogoutNotSupportedError();
+                }
                 var endpoint = this.replacePath(this.metadata.end_session_endpoint);
                 return this.replaceTenant(endpoint);
             }
@@ -6385,13 +6583,15 @@ var Authority = /** @class */ (function () {
         metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
         // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
         metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
-        metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        if (metadata.end_session_endpoint) {
+            metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        }
         return metadata;
     };
     return Authority;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6452,7 +6652,7 @@ var AuthorityFactory = /** @class */ (function () {
     return AuthorityFactory;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6483,7 +6683,7 @@ var ServerTelemetryEntity = /** @class */ (function () {
     return ServerTelemetryEntity;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6511,7 +6711,7 @@ var ThrottlingEntity = /** @class */ (function () {
     return ThrottlingEntity;
 }());
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6528,7 +6728,66 @@ var StubbedNetworkModule = {
     }
 };
 
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * This is a helper class that parses supported HTTP response authentication headers to extract and return
+ * header challenge values that can be used outside the basic authorization flows.
+ */
+var AuthenticationHeaderParser = /** @class */ (function () {
+    function AuthenticationHeaderParser(headers) {
+        this.headers = headers;
+    }
+    /**
+     * This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
+     * @returns
+     */
+    AuthenticationHeaderParser.prototype.getShrNonce = function () {
+        // Attempt to parse nonce from Authentiacation-Info
+        var authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        if (authenticationInfo) {
+            var authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
+            if (authenticationInfoChallenges.nextnonce) {
+                return authenticationInfoChallenges.nextnonce;
+            }
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
+        }
+        // Attempt to parse nonce from WWW-Authenticate
+        var wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        if (wwwAuthenticate) {
+            var wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
+            if (wwwAuthenticateChallenges.nonce) {
+                return wwwAuthenticateChallenges.nonce;
+            }
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
+        }
+        // If neither header is present, throw missing headers error
+        throw ClientConfigurationError.createMissingNonceAuthenticationHeadersError();
+    };
+    /**
+     * Parses an HTTP header's challenge set into a key/value map.
+     * @param header
+     * @returns
+     */
+    AuthenticationHeaderParser.prototype.parseChallenges = function (header) {
+        var schemeSeparator = header.indexOf(" ");
+        var challenges = header.substr(schemeSeparator + 1).split(",");
+        var challengeMap = {};
+        challenges.forEach(function (challenge) {
+            var _a = challenge.split("="), key = _a[0], value = _a[1];
+            // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
+            challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
+        });
+        return challengeMap;
+    };
+    return AuthenticationHeaderParser;
+}());
+
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6781,6 +7040,7 @@ exports.ApiId = void 0;
     ApiId[ApiId["ssoSilent"] = 863] = "ssoSilent";
     ApiId[ApiId["acquireTokenSilent_authCode"] = 864] = "acquireTokenSilent_authCode";
     ApiId[ApiId["handleRedirectPromise"] = 865] = "handleRedirectPromise";
+    ApiId[ApiId["acquireTokenByCode"] = 866] = "acquireTokenByCode";
     ApiId[ApiId["acquireTokenSilent_silentFlow"] = 61] = "acquireTokenSilent_silentFlow";
     ApiId[ApiId["logout"] = 961] = "logout";
     ApiId[ApiId["logoutPopup"] = 962] = "logoutPopup";
@@ -6841,7 +7101,11 @@ exports.WrapperSKU = void 0;
 (function (WrapperSKU) {
     WrapperSKU["React"] = "@azure/msal-react";
     WrapperSKU["Angular"] = "@azure/msal-angular";
-})(exports.WrapperSKU || (exports.WrapperSKU = {}));
+})(exports.WrapperSKU || (exports.WrapperSKU = {}));
+// DatabaseStorage Constants
+var DB_NAME = "msal.db";
+var DB_VERSION = 1;
+var DB_TABLE_NAME = DB_NAME + ".keys";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7303,10 +7567,6 @@ var BrowserAuthErrorMessage = {
         code: "iframe_closed_prematurely",
         desc: "The iframe being monitored was closed prematurely."
     },
-    silentSSOInsufficientInfoError: {
-        code: "silent_sso_error",
-        desc: "Silent SSO could not be completed - insufficient information was provided. Please provide either a loginHint or sid."
-    },
     silentLogoutUnsupportedError: {
         code: "silent_logout_unsupported",
         desc: "Silent logout not supported. Please call logoutRedirect or logoutPopup instead."
@@ -7321,7 +7581,7 @@ var BrowserAuthErrorMessage = {
     },
     noTokenRequestCacheError: {
         code: "no_token_request_cache_error",
-        desc: "No token request in found in cache."
+        desc: "No token request found in cache."
     },
     unableToParseTokenRequestCacheError: {
         code: "unable_to_parse_token_request_cache_error",
@@ -7370,6 +7630,14 @@ var BrowserAuthErrorMessage = {
     signingKeyNotFoundInStorage: {
         code: "crypto_key_not_found",
         desc: "Cryptographic Key or Keypair not found in browser storage."
+    },
+    authCodeRequired: {
+        code: "auth_code_required",
+        desc: "An authorization code must be provided (as the `code` property on the request) to this flow."
+    },
+    databaseUnavailable: {
+        code: "database_unavailable",
+        desc: "IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts."
     }
 };
 /**
@@ -7507,12 +7775,6 @@ var BrowserAuthError = /** @class */ (function (_super) {
     BrowserAuthError.createIframeClosedPrematurelyError = function () {
         return new BrowserAuthError(BrowserAuthErrorMessage.iframeClosedPrematurelyError.code, BrowserAuthErrorMessage.iframeClosedPrematurelyError.desc);
     };
-    /**
-     * Creates an error thrown when the login_hint, sid or account object is not provided in the ssoSilent API.
-     */
-    BrowserAuthError.createSilentSSOInsufficientInfoError = function () {
-        return new BrowserAuthError(BrowserAuthErrorMessage.silentSSOInsufficientInfoError.code, BrowserAuthErrorMessage.silentSSOInsufficientInfoError.desc);
-    };
     /**
      * Creates an error thrown when the logout API is called on any of the silent interaction clients
      */
@@ -7609,6 +7871,18 @@ var BrowserAuthError = /** @class */ (function (_super) {
     BrowserAuthError.createSigningKeyNotFoundInStorageError = function (keyId) {
         return new BrowserAuthError(BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code, BrowserAuthErrorMessage.signingKeyNotFoundInStorage.desc + " | No match found for KeyId: " + keyId);
     };
+    /**
+     * Create an error when an authorization code is required but not provided
+     */
+    BrowserAuthError.createAuthCodeRequiredError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.authCodeRequired.code, BrowserAuthErrorMessage.authCodeRequired.desc);
+    };
+    /**
+     * Create an error when IndexedDB is unavailable
+     */
+    BrowserAuthError.createDatabaseUnavailableError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.databaseUnavailable.code, BrowserAuthErrorMessage.databaseUnavailable.desc);
+    };
     return BrowserAuthError;
 }(AuthError));
 
@@ -7711,7 +7985,8 @@ var PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
  * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
  */
 var BrowserCrypto = /** @class */ (function () {
-    function BrowserCrypto() {
+    function BrowserCrypto(logger) {
+        this.logger = logger;
         if (!(this.hasCryptoAPI())) {
             throw BrowserAuthError.createCryptoNotAvailableError("Browser crypto or msCrypto object not available.");
         }
@@ -7970,10 +8245,10 @@ var BrowserCrypto = /** @class */ (function () {
  * Storage wrapper for IndexedDB storage in browsers: https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API
  */
 var DatabaseStorage = /** @class */ (function () {
-    function DatabaseStorage(dbName, tableName, version) {
-        this.dbName = dbName;
-        this.tableName = tableName;
-        this.version = version;
+    function DatabaseStorage() {
+        this.dbName = DB_NAME;
+        this.version = DB_VERSION;
+        this.tableName = DB_TABLE_NAME;
         this.dbOpen = false;
     }
     /**
@@ -7984,7 +8259,6 @@ var DatabaseStorage = /** @class */ (function () {
             var _this = this;
             return __generator$1(this, function (_a) {
                 return [2 /*return*/, new Promise(function (resolve, reject) {
-                        // TODO: Add timeouts?
                         var openDB = window.indexedDB.open(_this.dbName, _this.version);
                         openDB.addEventListener("upgradeneeded", function (e) {
                             var event = e;
@@ -7996,40 +8270,53 @@ var DatabaseStorage = /** @class */ (function () {
                             _this.dbOpen = true;
                             resolve();
                         });
-                        openDB.addEventListener("error", function (error) { return reject(error); });
+                        openDB.addEventListener("error", function () { return reject(BrowserAuthError.createDatabaseUnavailableError()); });
                     })];
             });
         });
     };
     /**
-     * Retrieves item from IndexedDB instance.
-     * @param key
+     * Opens database if it's not already open
      */
-    DatabaseStorage.prototype.get = function (key) {
+    DatabaseStorage.prototype.validateDbIsOpen = function () {
         return __awaiter$1(this, void 0, void 0, function () {
-            var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         if (!!this.dbOpen) return [3 /*break*/, 2];
                         return [4 /*yield*/, this.open()];
+                    case 1: return [2 /*return*/, _a.sent()];
+                    case 2: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Retrieves item from IndexedDB instance.
+     * @param key
+     */
+    DatabaseStorage.prototype.getItem = function (key) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var _this = this;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.validateDbIsOpen()];
                     case 1:
                         _a.sent();
-                        _a.label = 2;
-                    case 2: return [2 /*return*/, new Promise(function (resolve, reject) {
-                            // TODO: Add timeouts?
-                            if (!_this.db) {
-                                return reject(BrowserAuthError.createDatabaseNotOpenError());
-                            }
-                            var transaction = _this.db.transaction([_this.tableName], "readonly");
-                            var objectStore = transaction.objectStore(_this.tableName);
-                            var dbGet = objectStore.get(key);
-                            dbGet.addEventListener("success", function (e) {
-                                var event = e;
-                                resolve(event.target.result);
-                            });
-                            dbGet.addEventListener("error", function (e) { return reject(e); });
-                        })];
+                        return [2 /*return*/, new Promise(function (resolve, reject) {
+                                // TODO: Add timeouts?
+                                if (!_this.db) {
+                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                }
+                                var transaction = _this.db.transaction([_this.tableName], "readonly");
+                                var objectStore = transaction.objectStore(_this.tableName);
+                                var dbGet = objectStore.get(key);
+                                dbGet.addEventListener("success", function (e) {
+                                    var event = e;
+                                    resolve(event.target.result);
+                                });
+                                dbGet.addEventListener("error", function (e) { return reject(e); });
+                            })];
                 }
             });
         });
@@ -8039,31 +8326,25 @@ var DatabaseStorage = /** @class */ (function () {
      * @param key
      * @param payload
      */
-    DatabaseStorage.prototype.put = function (key, payload) {
+    DatabaseStorage.prototype.setItem = function (key, payload) {
         return __awaiter$1(this, void 0, void 0, function () {
             var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        if (!!this.dbOpen) return [3 /*break*/, 2];
-                        return [4 /*yield*/, this.open()];
+                    case 0: return [4 /*yield*/, this.validateDbIsOpen()];
                     case 1:
                         _a.sent();
-                        _a.label = 2;
-                    case 2: return [2 /*return*/, new Promise(function (resolve, reject) {
-                            // TODO: Add timeouts?
-                            if (!_this.db) {
-                                return reject(BrowserAuthError.createDatabaseNotOpenError());
-                            }
-                            var transaction = _this.db.transaction([_this.tableName], "readwrite");
-                            var objectStore = transaction.objectStore(_this.tableName);
-                            var dbPut = objectStore.put(payload, key);
-                            dbPut.addEventListener("success", function (e) {
-                                var event = e;
-                                resolve(event.target.result);
-                            });
-                            dbPut.addEventListener("error", function (e) { return reject(e); });
-                        })];
+                        return [2 /*return*/, new Promise(function (resolve, reject) {
+                                // TODO: Add timeouts?
+                                if (!_this.db) {
+                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                }
+                                var transaction = _this.db.transaction([_this.tableName], "readwrite");
+                                var objectStore = transaction.objectStore(_this.tableName);
+                                var dbPut = objectStore.put(payload, key);
+                                dbPut.addEventListener("success", function () { return resolve(); });
+                                dbPut.addEventListener("error", function (e) { return reject(e); });
+                            })];
                 }
             });
         });
@@ -8072,62 +8353,101 @@ var DatabaseStorage = /** @class */ (function () {
      * Removes item from IndexedDB under given key
      * @param key
      */
-    DatabaseStorage.prototype.delete = function (key) {
+    DatabaseStorage.prototype.removeItem = function (key) {
         return __awaiter$1(this, void 0, void 0, function () {
             var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        if (!!this.dbOpen) return [3 /*break*/, 2];
-                        return [4 /*yield*/, this.open()];
+                    case 0: return [4 /*yield*/, this.validateDbIsOpen()];
                     case 1:
                         _a.sent();
-                        _a.label = 2;
-                    case 2: return [2 /*return*/, new Promise(function (resolve, reject) {
-                            if (!_this.db) {
-                                return reject(BrowserAuthError.createDatabaseNotOpenError());
-                            }
-                            var transaction = _this.db.transaction([_this.tableName], "readwrite");
-                            var objectStore = transaction.objectStore(_this.tableName);
-                            var dbDelete = objectStore.delete(key);
-                            dbDelete.addEventListener("success", function (e) {
-                                var event = e;
-                                resolve(event.target.result === undefined);
-                            });
-                            dbDelete.addEventListener("error", function (e) { return reject(e); });
-                        })];
+                        return [2 /*return*/, new Promise(function (resolve, reject) {
+                                if (!_this.db) {
+                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                }
+                                var transaction = _this.db.transaction([_this.tableName], "readwrite");
+                                var objectStore = transaction.objectStore(_this.tableName);
+                                var dbDelete = objectStore.delete(key);
+                                dbDelete.addEventListener("success", function () { return resolve(); });
+                                dbDelete.addEventListener("error", function (e) { return reject(e); });
+                            })];
                 }
             });
         });
     };
-    DatabaseStorage.prototype.clear = function () {
+    /**
+     * Get all the keys from the storage object as an iterable array of strings.
+     */
+    DatabaseStorage.prototype.getKeys = function () {
         return __awaiter$1(this, void 0, void 0, function () {
             var _this = this;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        if (!!this.dbOpen) return [3 /*break*/, 2];
-                        return [4 /*yield*/, this.open()];
+                    case 0: return [4 /*yield*/, this.validateDbIsOpen()];
                     case 1:
                         _a.sent();
-                        _a.label = 2;
-                    case 2: return [2 /*return*/, new Promise(function (resolve, reject) {
-                            if (!_this.db) {
-                                return reject(BrowserAuthError.createDatabaseNotOpenError());
-                            }
-                            var transaction = _this.db.transaction([_this.tableName], "readwrite");
-                            var objectStore = transaction.objectStore(_this.tableName);
-                            var dbDelete = objectStore.clear();
-                            dbDelete.addEventListener("success", function (e) {
-                                var event = e;
-                                resolve(event.target.result === undefined);
-                            });
-                            dbDelete.addEventListener("error", function (e) { return reject(e); });
-                        })];
+                        return [2 /*return*/, new Promise(function (resolve, reject) {
+                                if (!_this.db) {
+                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                }
+                                var transaction = _this.db.transaction([_this.tableName], "readonly");
+                                var objectStore = transaction.objectStore(_this.tableName);
+                                var dbGetKeys = objectStore.getAllKeys();
+                                dbGetKeys.addEventListener("success", function (e) {
+                                    var event = e;
+                                    resolve(event.target.result);
+                                });
+                                dbGetKeys.addEventListener("error", function (e) { return reject(e); });
+                            })];
+                }
+            });
+        });
+    };
+    /**
+     *
+     * Checks whether there is an object under the search key in the object store
+     */
+    DatabaseStorage.prototype.containsKey = function (key) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var _this = this;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.validateDbIsOpen()];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/, new Promise(function (resolve, reject) {
+                                if (!_this.db) {
+                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                }
+                                var transaction = _this.db.transaction([_this.tableName], "readonly");
+                                var objectStore = transaction.objectStore(_this.tableName);
+                                var dbContainsKey = objectStore.count(key);
+                                dbContainsKey.addEventListener("success", function (e) {
+                                    var event = e;
+                                    resolve(event.target.result === 1);
+                                });
+                                dbContainsKey.addEventListener("error", function (e) { return reject(e); });
+                            })];
                 }
             });
         });
     };
+    /**
+     * Deletes the MSAL database. The database is deleted rather than cleared to make it possible
+     * for client applications to downgrade to a previous MSAL version without worrying about forward compatibility issues
+     * with IndexedDB database versions.
+     */
+    DatabaseStorage.prototype.deleteDatabase = function () {
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        var deleteDbRequest = window.indexedDB.deleteDatabase(DB_NAME);
+                        deleteDbRequest.addEventListener("success", function () { return resolve(true); });
+                        deleteDbRequest.addEventListener("error", function () { return reject(false); });
+                    })];
+            });
+        });
+    };
     return DatabaseStorage;
 }());
 
@@ -8135,31 +8455,254 @@ var DatabaseStorage = /** @class */ (function () {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-/**
- * This class implements MSAL's crypto interface, which allows it to perform base64 encoding and decoding, generating cryptographically random GUIDs and
- * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
- */
-var CryptoOps = /** @class */ (function () {
-    function CryptoOps() {
-        // Browser crypto needs to be validated first before any other classes can be set.
-        this.browserCrypto = new BrowserCrypto();
-        this.b64Encode = new Base64Encode();
-        this.b64Decode = new Base64Decode();
-        this.guidGenerator = new GuidGenerator(this.browserCrypto);
-        this.pkceGenerator = new PkceGenerator(this.browserCrypto);
-        this.cache = new DatabaseStorage(CryptoOps.DB_NAME, CryptoOps.TABLE_NAME, CryptoOps.DB_VERSION);
+var MemoryStorage = /** @class */ (function () {
+    function MemoryStorage() {
+        this.cache = new Map();
     }
-    /**
-     * Creates a new random GUID - used to populate state and nonce.
-     * @returns string (GUID)
-     */
-    CryptoOps.prototype.createNewGuid = function () {
-        return this.guidGenerator.generateGuid();
+    MemoryStorage.prototype.getItem = function (key) {
+        return this.cache.get(key) || null;
     };
-    /**
-     * Encodes input string to base64.
-     * @param input
-     */
+    MemoryStorage.prototype.setItem = function (key, value) {
+        this.cache.set(key, value);
+    };
+    MemoryStorage.prototype.removeItem = function (key) {
+        this.cache.delete(key);
+    };
+    MemoryStorage.prototype.getKeys = function () {
+        var cacheKeys = [];
+        this.cache.forEach(function (value, key) {
+            cacheKeys.push(key);
+        });
+        return cacheKeys;
+    };
+    MemoryStorage.prototype.containsKey = function (key) {
+        return this.cache.has(key);
+    };
+    MemoryStorage.prototype.clear = function () {
+        this.cache.clear();
+    };
+    return MemoryStorage;
+}());
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * This class allows MSAL to store artifacts asynchronously using the DatabaseStorage IndexedDB wrapper,
+ * backed up with the more volatile MemoryStorage object for cases in which IndexedDB may be unavailable.
+ */
+var AsyncMemoryStorage = /** @class */ (function () {
+    function AsyncMemoryStorage(logger) {
+        this.inMemoryCache = new MemoryStorage();
+        this.indexedDBCache = new DatabaseStorage();
+        this.logger = logger;
+    }
+    AsyncMemoryStorage.prototype.handleDatabaseAccessError = function (error) {
+        if (error instanceof BrowserAuthError && error.errorCode === BrowserAuthErrorMessage.databaseUnavailable.code) {
+            this.logger.error("Could not access persistent storage. This may be caused by browser privacy features which block persistent storage in third-party contexts.");
+        }
+    };
+    /**
+     * Get the item matching the given key. Tries in-memory cache first, then in the asynchronous
+     * storage object if item isn't found in-memory.
+     * @param key
+     */
+    AsyncMemoryStorage.prototype.getItem = function (key) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var item, e_1;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        item = this.inMemoryCache.getItem(key);
+                        if (!!item) return [3 /*break*/, 4];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        this.logger.verbose("Queried item not found in in-memory cache, now querying persistent storage.");
+                        return [4 /*yield*/, this.indexedDBCache.getItem(key)];
+                    case 2: return [2 /*return*/, _a.sent()];
+                    case 3:
+                        e_1 = _a.sent();
+                        this.handleDatabaseAccessError(e_1);
+                        return [3 /*break*/, 4];
+                    case 4: return [2 /*return*/, item];
+                }
+            });
+        });
+    };
+    /**
+     * Sets the item in the in-memory cache and then tries to set it in the asynchronous
+     * storage object with the given key.
+     * @param key
+     * @param value
+     */
+    AsyncMemoryStorage.prototype.setItem = function (key, value) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var e_2;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.inMemoryCache.setItem(key, value);
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.indexedDBCache.setItem(key, value)];
+                    case 2:
+                        _a.sent();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        e_2 = _a.sent();
+                        this.handleDatabaseAccessError(e_2);
+                        return [3 /*break*/, 4];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Removes the item matching the key from the in-memory cache, then tries to remove it from the asynchronous storage object.
+     * @param key
+     */
+    AsyncMemoryStorage.prototype.removeItem = function (key) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var e_3;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.inMemoryCache.removeItem(key);
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.indexedDBCache.removeItem(key)];
+                    case 2:
+                        _a.sent();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        e_3 = _a.sent();
+                        this.handleDatabaseAccessError(e_3);
+                        return [3 /*break*/, 4];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Get all the keys from the in-memory cache as an iterable array of strings. If no keys are found, query the keys in the
+     * asynchronous storage object.
+     */
+    AsyncMemoryStorage.prototype.getKeys = function () {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var cacheKeys, e_4;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        cacheKeys = this.inMemoryCache.getKeys();
+                        if (!(cacheKeys.length === 0)) return [3 /*break*/, 4];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        this.logger.verbose("In-memory cache is empty, now querying persistent storage.");
+                        return [4 /*yield*/, this.indexedDBCache.getKeys()];
+                    case 2: return [2 /*return*/, _a.sent()];
+                    case 3:
+                        e_4 = _a.sent();
+                        this.handleDatabaseAccessError(e_4);
+                        return [3 /*break*/, 4];
+                    case 4: return [2 /*return*/, cacheKeys];
+                }
+            });
+        });
+    };
+    /**
+     * Returns true or false if the given key is present in the cache.
+     * @param key
+     */
+    AsyncMemoryStorage.prototype.containsKey = function (key) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var containsKey, e_5;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        containsKey = this.inMemoryCache.containsKey(key);
+                        if (!!containsKey) return [3 /*break*/, 4];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        this.logger.verbose("Key not found in in-memory cache, now querying persistent storage.");
+                        return [4 /*yield*/, this.indexedDBCache.containsKey(key)];
+                    case 2: return [2 /*return*/, _a.sent()];
+                    case 3:
+                        e_5 = _a.sent();
+                        this.handleDatabaseAccessError(e_5);
+                        return [3 /*break*/, 4];
+                    case 4: return [2 /*return*/, containsKey];
+                }
+            });
+        });
+    };
+    /**
+     * Clears in-memory Map and tries to delete the IndexedDB database.
+     */
+    AsyncMemoryStorage.prototype.clear = function () {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var e_6;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.inMemoryCache.clear();
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.indexedDBCache.deleteDatabase()];
+                    case 2:
+                        _a.sent();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        e_6 = _a.sent();
+                        this.handleDatabaseAccessError(e_6);
+                        return [3 /*break*/, 4];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    return AsyncMemoryStorage;
+}());
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * This class implements MSAL's crypto interface, which allows it to perform base64 encoding and decoding, generating cryptographically random GUIDs and
+ * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
+ */
+var CryptoOps = /** @class */ (function () {
+    function CryptoOps(logger) {
+        this.logger = logger;
+        // Browser crypto needs to be validated first before any other classes can be set.
+        this.browserCrypto = new BrowserCrypto(this.logger);
+        this.b64Encode = new Base64Encode();
+        this.b64Decode = new Base64Decode();
+        this.guidGenerator = new GuidGenerator(this.browserCrypto);
+        this.pkceGenerator = new PkceGenerator(this.browserCrypto);
+        this.cache = {
+            asymmetricKeys: new AsyncMemoryStorage(this.logger),
+            symmetricKeys: new AsyncMemoryStorage(this.logger)
+        };
+    }
+    /**
+     * Creates a new random GUID - used to populate state and nonce.
+     * @returns string (GUID)
+     */
+    CryptoOps.prototype.createNewGuid = function () {
+        return this.guidGenerator.generateGuid();
+    };
+    /**
+     * Encodes input string to base64.
+     * @param input
+     */
     CryptoOps.prototype.base64Encode = function (input) {
         return this.b64Encode.encode(input);
     };
@@ -8186,7 +8729,7 @@ var CryptoOps = /** @class */ (function () {
      */
     CryptoOps.prototype.getPublicKeyThumbprint = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var keyPair, publicKeyJwk, pubKeyThumprintObj, publicJwkString, publicJwkBuffer, publicJwkHash, privateKeyJwk, unextractablePrivateKey;
+            var keyPair, publicKeyJwk, pubKeyThumprintObj, publicJwkString, publicJwkHash, privateKeyJwk, unextractablePrivateKey;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0: return [4 /*yield*/, this.browserCrypto.generateKeyPair(CryptoOps.EXTRACTABLE, CryptoOps.POP_KEY_USAGES)];
@@ -8201,10 +8744,9 @@ var CryptoOps = /** @class */ (function () {
                             n: publicKeyJwk.n
                         };
                         publicJwkString = BrowserCrypto.getJwkString(pubKeyThumprintObj);
-                        return [4 /*yield*/, this.browserCrypto.sha256Digest(publicJwkString)];
+                        return [4 /*yield*/, this.hashString(publicJwkString)];
                     case 3:
-                        publicJwkBuffer = _a.sent();
-                        publicJwkHash = this.b64Encode.urlEncodeArr(new Uint8Array(publicJwkBuffer));
+                        publicJwkHash = _a.sent();
                         return [4 /*yield*/, this.browserCrypto.exportJwk(keyPair.privateKey)];
                     case 4:
                         privateKeyJwk = _a.sent();
@@ -8212,7 +8754,7 @@ var CryptoOps = /** @class */ (function () {
                     case 5:
                         unextractablePrivateKey = _a.sent();
                         // Store Keypair data in keystore
-                        return [4 /*yield*/, this.cache.put(publicJwkHash, {
+                        return [4 /*yield*/, this.cache.asymmetricKeys.setItem(publicJwkHash, {
                                 privateKey: unextractablePrivateKey,
                                 publicKey: keyPair.publicKey,
                                 requestMethod: request.resourceRequestMethod,
@@ -8232,8 +8774,17 @@ var CryptoOps = /** @class */ (function () {
      */
     CryptoOps.prototype.removeTokenBindingKey = function (kid) {
         return __awaiter$1(this, void 0, void 0, function () {
+            var keyFound;
             return __generator$1(this, function (_a) {
-                return [2 /*return*/, this.cache.delete(kid)];
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.cache.asymmetricKeys.removeItem(kid)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, this.cache.asymmetricKeys.containsKey(kid)];
+                    case 2:
+                        keyFound = _a.sent();
+                        return [2 /*return*/, !keyFound];
+                }
             });
         });
     };
@@ -8242,8 +8793,22 @@ var CryptoOps = /** @class */ (function () {
      */
     CryptoOps.prototype.clearKeystore = function () {
         return __awaiter$1(this, void 0, void 0, function () {
-            return __generator$1(this, function (_a) {
-                return [2 /*return*/, this.cache.clear()];
+            var dataStoreNames, databaseStorage, _a;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dataStoreNames = Object.keys(this.cache);
+                        databaseStorage = this.cache[dataStoreNames[0]];
+                        if (!databaseStorage) return [3 /*break*/, 2];
+                        return [4 /*yield*/, databaseStorage.deleteDatabase()];
+                    case 1:
+                        _a = _b.sent();
+                        return [3 /*break*/, 3];
+                    case 2:
+                        _a = false;
+                        _b.label = 3;
+                    case 3: return [2 /*return*/, _a];
+                }
             });
         });
     };
@@ -8257,7 +8822,7 @@ var CryptoOps = /** @class */ (function () {
             var cachedKeyPair, publicKeyJwk, publicKeyJwkString, header, encodedHeader, encodedPayload, tokenString, tokenBuffer, signatureBuffer, encodedSignature;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, this.cache.get(kid)];
+                    case 0: return [4 /*yield*/, this.cache.asymmetricKeys.getItem(kid)];
                     case 1:
                         cachedKeyPair = _a.sent();
                         if (!cachedKeyPair) {
@@ -8288,11 +8853,26 @@ var CryptoOps = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Returns the SHA-256 hash of an input string
+     * @param plainText
+     */
+    CryptoOps.prototype.hashString = function (plainText) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var hashBuffer, hashBytes;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.browserCrypto.sha256Digest(plainText)];
+                    case 1:
+                        hashBuffer = _a.sent();
+                        hashBytes = new Uint8Array(hashBuffer);
+                        return [2 /*return*/, this.b64Encode.urlEncodeArr(hashBytes)];
+                }
+            });
+        });
+    };
     CryptoOps.POP_KEY_USAGES = ["sign", "verify"];
     CryptoOps.EXTRACTABLE = true;
-    CryptoOps.DB_VERSION = 1;
-    CryptoOps.DB_NAME = "msal.db";
-    CryptoOps.TABLE_NAME = CryptoOps.DB_NAME + ".keys";
     return CryptoOps;
 }());
 
@@ -8422,39 +9002,6 @@ var BrowserStorage = /** @class */ (function () {
     return BrowserStorage;
 }());
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-var MemoryStorage = /** @class */ (function () {
-    function MemoryStorage() {
-        this.cache = new Map();
-    }
-    MemoryStorage.prototype.getItem = function (key) {
-        return this.cache.get(key) || null;
-    };
-    MemoryStorage.prototype.setItem = function (key, value) {
-        this.cache.set(key, value);
-    };
-    MemoryStorage.prototype.removeItem = function (key) {
-        this.cache.delete(key);
-    };
-    MemoryStorage.prototype.getKeys = function () {
-        var cacheKeys = [];
-        this.cache.forEach(function (value, key) {
-            cacheKeys.push(key);
-        });
-        return cacheKeys;
-    };
-    MemoryStorage.prototype.containsKey = function (key) {
-        return this.cache.has(key);
-    };
-    MemoryStorage.prototype.clear = function () {
-        this.cache.clear();
-    };
-    return MemoryStorage;
-}());
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -9245,6 +9792,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             }
         });
         this.clearMsalCookies();
+        this.setInteractionInProgress(false);
     };
     BrowserCacheManager.prototype.cacheCodeRequest = function (authCodeRequest, browserCrypto) {
         this.logger.trace("BrowserCacheManager.cacheCodeRequest called");
@@ -9302,6 +9850,58 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             this.removeItem(key);
         }
     };
+    /**
+     * Returns username retrieved from ADAL or MSAL v1 idToken
+     */
+    BrowserCacheManager.prototype.getLegacyLoginHint = function () {
+        // Only check for adal/msal token if no SSO params are being used
+        var adalIdTokenString = this.getTemporaryCache(PersistentCacheKeys.ADAL_ID_TOKEN);
+        if (adalIdTokenString) {
+            this.browserStorage.removeItem(PersistentCacheKeys.ADAL_ID_TOKEN);
+            this.logger.verbose("Cached ADAL id token retrieved.");
+        }
+        // Check for cached MSAL v1 id token
+        var msalIdTokenString = this.getTemporaryCache(PersistentCacheKeys.ID_TOKEN, true);
+        if (msalIdTokenString) {
+            this.removeItem(this.generateCacheKey(PersistentCacheKeys.ID_TOKEN));
+            this.logger.verbose("Cached MSAL.js v1 id token retrieved");
+        }
+        var cachedIdTokenString = msalIdTokenString || adalIdTokenString;
+        if (cachedIdTokenString) {
+            var cachedIdToken = new AuthToken(cachedIdTokenString, this.cryptoImpl);
+            if (cachedIdToken.claims && cachedIdToken.claims.preferred_username) {
+                this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 preferred_username as loginHint");
+                return cachedIdToken.claims.preferred_username;
+            }
+            else if (cachedIdToken.claims && cachedIdToken.claims.upn) {
+                this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 upn as loginHint");
+                return cachedIdToken.claims.upn;
+            }
+            else {
+                this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, however, no account hint claim found. Enable preferred_username or upn id token claim to get SSO.");
+            }
+        }
+        return null;
+    };
+    /**
+     * Updates a credential's cache key if the current cache key is outdated
+     */
+    BrowserCacheManager.prototype.updateCredentialCacheKey = function (currentCacheKey, credential) {
+        var updatedCacheKey = credential.generateCredentialKey();
+        if (currentCacheKey !== updatedCacheKey) {
+            var cacheItem = this.getItem(currentCacheKey);
+            if (cacheItem) {
+                this.removeItem(currentCacheKey);
+                this.setItem(updatedCacheKey, cacheItem);
+                this.logger.verbose("Updated an outdated " + credential.credentialType + " cache key");
+                return updatedCacheKey;
+            }
+            else {
+                this.logger.error("Attempted to update an outdated " + credential.credentialType + " cache key but no item matching the outdated key was found in storage");
+            }
+        }
+        return currentCacheKey;
+    };
     return BrowserCacheManager;
 }(CacheManager));
 var DEFAULT_BROWSER_CACHE_MANAGER = function (clientId, logger) {
@@ -9802,7 +10402,7 @@ function buildConfiguration(_a, isBrowserEnvironment) {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-browser";
-var version = "2.17.0";
+var version = "2.21.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9810,6 +10410,8 @@ var version = "2.17.0";
  */
 exports.EventType = void 0;
 (function (EventType) {
+    EventType["ACCOUNT_ADDED"] = "msal:accountAdded";
+    EventType["ACCOUNT_REMOVED"] = "msal:accountRemoved";
     EventType["LOGIN_START"] = "msal:loginStart";
     EventType["LOGIN_SUCCESS"] = "msal:loginSuccess";
     EventType["LOGIN_FAILURE"] = "msal:loginFailure";
@@ -9820,6 +10422,9 @@ exports.EventType = void 0;
     EventType["SSO_SILENT_START"] = "msal:ssoSilentStart";
     EventType["SSO_SILENT_SUCCESS"] = "msal:ssoSilentSuccess";
     EventType["SSO_SILENT_FAILURE"] = "msal:ssoSilentFailure";
+    EventType["ACQUIRE_TOKEN_BY_CODE_START"] = "msal:acquireTokenByCodeStart";
+    EventType["ACQUIRE_TOKEN_BY_CODE_SUCCESS"] = "msal:acquireTokenByCodeSuccess";
+    EventType["ACQUIRE_TOKEN_BY_CODE_FAILURE"] = "msal:acquireTokenByCodeFailure";
     EventType["HANDLE_REDIRECT_START"] = "msal:handleRedirectStart";
     EventType["HANDLE_REDIRECT_END"] = "msal:handleRedirectEnd";
     EventType["POPUP_OPENED"] = "msal:popupOpened";
@@ -9838,6 +10443,8 @@ var EventHandler = /** @class */ (function () {
         this.eventCallbacks = new Map();
         this.logger = logger;
         this.browserCrypto = browserCrypto;
+        this.listeningToStorageEvents = false;
+        this.handleAccountCacheChange = this.handleAccountCacheChange.bind(this);
     }
     /**
      * Adds event callbacks to array
@@ -9860,6 +10467,38 @@ var EventHandler = /** @class */ (function () {
         this.eventCallbacks.delete(callbackId);
         this.logger.verbose("Event callback " + callbackId + " removed.");
     };
+    /**
+     * Adds event listener that emits an event when a user account is added or removed from localstorage in a different browser tab or window
+     */
+    EventHandler.prototype.enableAccountStorageEvents = function () {
+        if (typeof window === "undefined") {
+            return;
+        }
+        if (!this.listeningToStorageEvents) {
+            this.logger.verbose("Adding account storage listener.");
+            this.listeningToStorageEvents = true;
+            window.addEventListener("storage", this.handleAccountCacheChange);
+        }
+        else {
+            this.logger.verbose("Account storage listener already registered.");
+        }
+    };
+    /**
+     * Removes event listener that emits an event when a user account is added or removed from localstorage in a different browser tab or window
+     */
+    EventHandler.prototype.disableAccountStorageEvents = function () {
+        if (typeof window === "undefined") {
+            return;
+        }
+        if (this.listeningToStorageEvents) {
+            this.logger.verbose("Removing account storage listener.");
+            window.removeEventListener("storage", this.handleAccountCacheChange);
+            this.listeningToStorageEvents = false;
+        }
+        else {
+            this.logger.verbose("No account storage listener registered.");
+        }
+    };
     /**
      * Emits events by calling callback with event message
      * @param eventType
@@ -9884,6 +10523,34 @@ var EventHandler = /** @class */ (function () {
             });
         }
     };
+    /**
+     * Emit account added/removed events when cached accounts are changed in a different tab or frame
+     */
+    EventHandler.prototype.handleAccountCacheChange = function (e) {
+        try {
+            var cacheValue = e.newValue || e.oldValue;
+            if (!cacheValue) {
+                return;
+            }
+            var parsedValue = JSON.parse(cacheValue);
+            if (typeof parsedValue !== "object" || !AccountEntity.isAccountEntity(parsedValue)) {
+                return;
+            }
+            var accountEntity = CacheManager.toObject(new AccountEntity(), parsedValue);
+            var accountInfo = accountEntity.getAccountInfo();
+            if (!e.oldValue && e.newValue) {
+                this.logger.info("Account was added to cache in a different window");
+                this.emitEvent(exports.EventType.ACCOUNT_ADDED, undefined, accountInfo);
+            }
+            else if (!e.newValue && e.oldValue) {
+                this.logger.info("Account was removed from cache in a different window");
+                this.emitEvent(exports.EventType.ACCOUNT_REMOVED, undefined, accountInfo);
+            }
+        }
+        catch (e) {
+            return;
+        }
+    };
     return EventHandler;
 }());
 
@@ -9947,6 +10614,79 @@ var BaseInteractionClient = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Initializer function for all request APIs
+     * @param request
+     */
+    BaseInteractionClient.prototype.initializeBaseRequest = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var authority, scopes, _a, validatedRequest;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.verbose("Initializing BaseAuthRequest");
+                        authority = request.authority || this.config.auth.authority;
+                        scopes = __spread(((request && request.scopes) || []));
+                        // Set authenticationScheme to BEARER if not explicitly set in the request
+                        if (!request.authenticationScheme) {
+                            request.authenticationScheme = exports.AuthenticationScheme.BEARER;
+                            this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
+                        }
+                        else {
+                            if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                                if (!request.sshJwk) {
+                                    throw ClientConfigurationError.createMissingSshJwkError();
+                                }
+                                if (!request.sshKid) {
+                                    throw ClientConfigurationError.createMissingSshKidError();
+                                }
+                            }
+                            this.logger.verbose("Authentication Scheme set to \"" + request.authenticationScheme + "\" as configured in Auth request");
+                        }
+                        if (!(request.claims && !StringUtils.isEmpty(request.claims))) return [3 /*break*/, 2];
+                        _a = request;
+                        return [4 /*yield*/, this.browserCrypto.hashString(request.claims)];
+                    case 1:
+                        _a.requestedClaimsHash = _b.sent();
+                        _b.label = 2;
+                    case 2:
+                        validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
+                            scopes: scopes });
+                        return [2 /*return*/, validatedRequest];
+                }
+            });
+        });
+    };
+    /**
+     *
+     * Use to get the redirect uri configured in MSAL or null.
+     * @param requestRedirectUri
+     * @returns Redirect URL
+     *
+     */
+    BaseInteractionClient.prototype.getRedirectUri = function (requestRedirectUri) {
+        this.logger.verbose("getRedirectUri called");
+        var redirectUri = requestRedirectUri || this.config.auth.redirectUri || BrowserUtils.getCurrentUri();
+        return UrlString.getAbsoluteUrl(redirectUri, BrowserUtils.getCurrentUri());
+    };
+    /**
+     *
+     * @param apiId
+     * @param correlationId
+     * @param forceRefresh
+     */
+    BaseInteractionClient.prototype.initializeServerTelemetryManager = function (apiId, forceRefresh) {
+        this.logger.verbose("initializeServerTelemetryManager called");
+        var telemetryPayload = {
+            clientId: this.config.auth.clientId,
+            correlationId: this.correlationId,
+            apiId: apiId,
+            forceRefresh: forceRefresh || false,
+            wrapperSKU: this.browserStorage.getWrapperMetadata()[0],
+            wrapperVer: this.browserStorage.getWrapperMetadata()[1]
+        };
+        return new ServerTelemetryManager(telemetryPayload, this.browserStorage);
+    };
     return BaseInteractionClient;
 }());
 
@@ -10139,122 +10879,68 @@ var StandardInteractionClient = /** @class */ (function (_super) {
             });
         });
     };
-    /**
-     *
-     * @param apiId
-     * @param correlationId
-     * @param forceRefresh
-     */
-    StandardInteractionClient.prototype.initializeServerTelemetryManager = function (apiId, forceRefresh) {
-        this.logger.verbose("initializeServerTelemetryManager called");
-        var telemetryPayload = {
-            clientId: this.config.auth.clientId,
-            correlationId: this.correlationId,
-            apiId: apiId,
-            forceRefresh: forceRefresh || false,
-            wrapperSKU: this.browserStorage.getWrapperMetadata()[0],
-            wrapperVer: this.browserStorage.getWrapperMetadata()[1]
-        };
-        return new ServerTelemetryManager(telemetryPayload, this.browserStorage);
-    };
     /**
      * Helper to validate app environment before making a request.
      * @param request
      * @param interactionType
      */
     StandardInteractionClient.prototype.preflightInteractiveRequest = function (request, interactionType) {
-        this.logger.verbose("preflightInteractiveRequest called, validating app environment", request === null || request === void 0 ? void 0 : request.correlationId);
-        // block the reload if it occurred inside a hidden iframe
-        BrowserUtils.blockReloadInHiddenIframes();
-        // Check if interaction is in progress. Throw error if true.
-        if (this.browserStorage.isInteractionInProgress(false)) {
-            throw BrowserAuthError.createInteractionInProgressError();
-        }
-        return this.initializeAuthorizationRequest(request, interactionType);
-    };
-    /**
-     * Helper to initialize required request parameters for interactive APIs and ssoSilent()
-     * @param request
-     * @param interactionType
-     */
-    StandardInteractionClient.prototype.initializeAuthorizationRequest = function (request, interactionType) {
-        this.logger.verbose("initializeAuthorizationRequest called");
-        var redirectUri = this.getRedirectUri(request.redirectUri);
-        var browserState = {
-            interactionType: interactionType
-        };
-        var state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || "", browserState);
-        var validatedRequest = __assign$1(__assign$1({}, this.initializeBaseRequest(request)), { redirectUri: redirectUri, state: state, nonce: request.nonce || this.browserCrypto.createNewGuid(), responseMode: ResponseMode.FRAGMENT });
-        var account = request.account || this.browserStorage.getActiveAccount();
-        if (account) {
-            this.logger.verbose("Setting validated request account");
-            this.logger.verbosePii("Setting validated request account: " + account);
-            validatedRequest.account = account;
-        }
-        // Check for ADAL/MSAL v1 SSO
-        if (StringUtils.isEmpty(validatedRequest.loginHint) && !account) {
-            // Only check for adal/msal token if no SSO params are being used
-            var adalIdTokenString = this.browserStorage.getTemporaryCache(PersistentCacheKeys.ADAL_ID_TOKEN);
-            if (adalIdTokenString) {
-                this.browserStorage.removeItem(PersistentCacheKeys.ADAL_ID_TOKEN);
-                this.logger.verbose("Cached ADAL id token retrieved.");
-            }
-            // Check for cached MSAL v1 id token
-            var msalIdTokenString = this.browserStorage.getTemporaryCache(PersistentCacheKeys.ID_TOKEN, true);
-            if (msalIdTokenString) {
-                this.browserStorage.removeItem(this.browserStorage.generateCacheKey(PersistentCacheKeys.ID_TOKEN));
-                this.logger.verbose("Cached MSAL.js v1 id token retrieved");
-            }
-            var cachedIdTokenString = msalIdTokenString || adalIdTokenString;
-            if (cachedIdTokenString) {
-                var cachedIdToken = new AuthToken(cachedIdTokenString, this.browserCrypto);
-                if (cachedIdToken.claims && cachedIdToken.claims.preferred_username) {
-                    this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 preferred_username as loginHint");
-                    validatedRequest.loginHint = cachedIdToken.claims.preferred_username;
-                }
-                else if (cachedIdToken.claims && cachedIdToken.claims.upn) {
-                    this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 upn as loginHint");
-                    validatedRequest.loginHint = cachedIdToken.claims.upn;
-                }
-                else {
-                    this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, however, no account hint claim found. Enable preferred_username or upn id token claim to get SSO.");
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.verbose("preflightInteractiveRequest called, validating app environment", request === null || request === void 0 ? void 0 : request.correlationId);
+                        // block the reload if it occurred inside a hidden iframe
+                        BrowserUtils.blockReloadInHiddenIframes();
+                        // Check if interaction is in progress. Throw error if true.
+                        if (this.browserStorage.isInteractionInProgress(false)) {
+                            throw BrowserAuthError.createInteractionInProgressError();
+                        }
+                        return [4 /*yield*/, this.initializeAuthorizationRequest(request, interactionType)];
+                    case 1: return [2 /*return*/, _a.sent()];
                 }
-            }
-        }
-        this.browserStorage.updateCacheEntries(validatedRequest.state, validatedRequest.nonce, validatedRequest.authority, validatedRequest.loginHint || "", validatedRequest.account || null);
-        return validatedRequest;
-    };
-    /**
-     * Initializer function for all request APIs
-     * @param request
-     */
-    StandardInteractionClient.prototype.initializeBaseRequest = function (request) {
-        this.logger.verbose("Initializing BaseAuthRequest");
-        var authority = request.authority || this.config.auth.authority;
-        var scopes = __spread(((request && request.scopes) || []));
-        // Set authenticationScheme to BEARER if not explicitly set in the request
-        if (!request.authenticationScheme) {
-            request.authenticationScheme = exports.AuthenticationScheme.BEARER;
-            this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
-        }
-        else {
-            this.logger.verbose("Authentication Scheme set to \"" + request.authenticationScheme + "\" as configured in Auth request");
-        }
-        var validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
-            scopes: scopes });
-        return validatedRequest;
+            });
+        });
     };
     /**
-     *
-     * Use to get the redirect uri configured in MSAL or null.
-     * @param requestRedirectUri
-     * @returns Redirect URL
-     *
+     * Helper to initialize required request parameters for interactive APIs and ssoSilent()
+     * @param request
+     * @param interactionType
      */
-    StandardInteractionClient.prototype.getRedirectUri = function (requestRedirectUri) {
-        this.logger.verbose("getRedirectUri called");
-        var redirectUri = requestRedirectUri || this.config.auth.redirectUri || BrowserUtils.getCurrentUri();
-        return UrlString.getAbsoluteUrl(redirectUri, BrowserUtils.getCurrentUri());
+    StandardInteractionClient.prototype.initializeAuthorizationRequest = function (request, interactionType) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var redirectUri, browserState, state, validatedRequest, _a, account, legacyLoginHint;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.verbose("initializeAuthorizationRequest called");
+                        redirectUri = this.getRedirectUri(request.redirectUri);
+                        browserState = {
+                            interactionType: interactionType
+                        };
+                        state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || "", browserState);
+                        _a = [{}];
+                        return [4 /*yield*/, this.initializeBaseRequest(request)];
+                    case 1:
+                        validatedRequest = __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { redirectUri: redirectUri, state: state, nonce: request.nonce || this.browserCrypto.createNewGuid(), responseMode: ResponseMode.FRAGMENT }]);
+                        account = request.account || this.browserStorage.getActiveAccount();
+                        if (account) {
+                            this.logger.verbose("Setting validated request account");
+                            this.logger.verbosePii("Setting validated request account: " + account);
+                            validatedRequest.account = account;
+                        }
+                        // Check for ADAL/MSAL v1 SSO
+                        if (StringUtils.isEmpty(validatedRequest.loginHint) && !account) {
+                            legacyLoginHint = this.browserStorage.getLegacyLoginHint();
+                            if (legacyLoginHint) {
+                                validatedRequest.loginHint = legacyLoginHint;
+                            }
+                        }
+                        this.browserStorage.updateCacheEntries(validatedRequest.state, validatedRequest.nonce, validatedRequest.authority, validatedRequest.loginHint || "", validatedRequest.account || null);
+                        return [2 /*return*/, validatedRequest];
+                }
+            });
+        });
     };
     return StandardInteractionClient;
 }(BaseInteractionClient));
@@ -10454,23 +11140,46 @@ var InteractionHandler = /** @class */ (function () {
      * Function to handle response parameters from hash.
      * @param locationHash
      */
-    InteractionHandler.prototype.handleCodeResponse = function (locationHash, state, authority, networkModule) {
+    InteractionHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var stateKey, requestState, authCodeResponse, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
+            var stateKey, requestState, authCodeResponse;
+            return __generator$1(this, function (_a) {
+                this.browserRequestLogger.verbose("InteractionHandler.handleCodeResponse called");
+                // Check that location hash isn't empty.
+                if (StringUtils.isEmpty(locationHash)) {
+                    throw BrowserAuthError.createEmptyHashError(locationHash);
+                }
+                stateKey = this.browserStorage.generateStateKey(state);
+                requestState = this.browserStorage.getTemporaryCache(stateKey);
+                if (!requestState) {
+                    throw ClientAuthError.createStateNotFoundError("Cached State");
+                }
+                authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                return [2 /*return*/, this.handleCodeResponseFromServer(authCodeResponse, state, authority, networkModule)];
+            });
+        });
+    };
+    /**
+     * Process auth code response from AAD
+     * @param authCodeResponse
+     * @param state
+     * @param authority
+     * @param networkModule
+     * @returns
+     */
+    InteractionHandler.prototype.handleCodeResponseFromServer = function (authCodeResponse, state, authority, networkModule, validateNonce) {
+        if (validateNonce === void 0) { validateNonce = true; }
+        return __awaiter$1(this, void 0, void 0, function () {
+            var stateKey, requestState, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        this.browserRequestLogger.verbose("InteractionHandler.handleCodeResponse called");
-                        // Check that location hash isn't empty.
-                        if (StringUtils.isEmpty(locationHash)) {
-                            throw BrowserAuthError.createEmptyHashError(locationHash);
-                        }
+                        this.browserRequestLogger.trace("InteractionHandler.handleCodeResponseFromServer called");
                         stateKey = this.browserStorage.generateStateKey(state);
                         requestState = this.browserStorage.getTemporaryCache(stateKey);
                         if (!requestState) {
                             throw ClientAuthError.createStateNotFoundError("Cached State");
                         }
-                        authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
                         nonceKey = this.browserStorage.generateNonceKey(requestState);
                         cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
                         // Assign code to request
@@ -10481,7 +11190,10 @@ var InteractionHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 2;
                     case 2:
-                        authCodeResponse.nonce = cachedNonce || undefined;
+                        // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
+                        if (validateNonce) {
+                            authCodeResponse.nonce = cachedNonce || undefined;
+                        }
                         authCodeResponse.state = requestState;
                         // Add CCS parameters if available
                         if (authCodeResponse.client_info) {
@@ -10618,26 +11330,36 @@ var PopupClient = /** @class */ (function (_super) {
      * @param request
      */
     PopupClient.prototype.acquireToken = function (request) {
-        try {
-            var validRequest = this.preflightInteractiveRequest(request, exports.InteractionType.Popup);
-            var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, validRequest);
-            var popupWindowAttributes = request.popupWindowAttributes || {};
-            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
-            if (this.config.system.asyncPopups) {
-                this.logger.verbose("asyncPopups set to true, acquiring token");
-                // Passes on popup position and dimensions if in request
-                return this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes);
-            }
-            else {
-                // asyncPopups flag is set to false. Opens popup before acquiring token.
-                this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
-                var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
-                return this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes, popup);
-            }
-        }
-        catch (e) {
-            return Promise.reject(e);
-        }
+        return __awaiter$1(this, void 0, void 0, function () {
+            var validRequest, popupName, popupWindowAttributes, popup, e_1;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        _a.trys.push([0, 2, , 3]);
+                        return [4 /*yield*/, this.preflightInteractiveRequest(request, exports.InteractionType.Popup)];
+                    case 1:
+                        validRequest = _a.sent();
+                        popupName = PopupUtils.generatePopupName(this.config.auth.clientId, validRequest);
+                        popupWindowAttributes = request.popupWindowAttributes || {};
+                        // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
+                        if (this.config.system.asyncPopups) {
+                            this.logger.verbose("asyncPopups set to true, acquiring token");
+                            // Passes on popup position and dimensions if in request
+                            return [2 /*return*/, this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes)];
+                        }
+                        else {
+                            // asyncPopups flag is set to false. Opens popup before acquiring token.
+                            this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
+                            popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
+                            return [2 /*return*/, this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes, popup)];
+                        }
+                    case 2:
+                        e_1 = _a.sent();
+                        return [2 /*return*/, Promise.reject(e_1)];
+                    case 3: return [2 /*return*/];
+                }
+            });
+        });
     };
     /**
      * Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
@@ -10680,7 +11402,7 @@ var PopupClient = /** @class */ (function (_super) {
      */
     PopupClient.prototype.acquireTokenPopupAsync = function (validRequest, popupName, popupWindowAttributes, popup) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var serverTelemetryManager, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_1;
+            var serverTelemetryManager, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_2;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -10713,22 +11435,22 @@ var PopupClient = /** @class */ (function (_super) {
                         state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Popup, validRequest.correlationId);
                         // Remove throttle if it exists
                         ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
-                        return [4 /*yield*/, interactionHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient)];
+                        return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                     case 6:
                         result = _a.sent();
                         return [2 /*return*/, result];
                     case 7:
-                        e_1 = _a.sent();
+                        e_2 = _a.sent();
                         if (popup) {
                             // Close the synchronous popup if an error is thrown before the window unload event is registered
                             popup.close();
                         }
-                        if (e_1 instanceof AuthError) {
-                            e_1.setCorrelationId(this.correlationId);
+                        if (e_2 instanceof AuthError) {
+                            e_2.setCorrelationId(this.correlationId);
                         }
-                        serverTelemetryManager.cacheFailedRequest(e_1);
+                        serverTelemetryManager.cacheFailedRequest(e_2);
                         this.browserStorage.cleanRequestByState(validRequest.state);
-                        throw e_1;
+                        throw e_2;
                     case 8: return [2 /*return*/];
                 }
             });
@@ -10745,7 +11467,7 @@ var PopupClient = /** @class */ (function (_super) {
      */
     PopupClient.prototype.logoutPopupAsync = function (validRequest, popupName, popupWindowAttributes, requestAuthority, popup, mainWindowRedirectUri) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var serverTelemetryManager, authClient, logoutUri, popupUtils, popupWindow, e_2, navigationOptions, absoluteUrl, e_3;
+            var serverTelemetryManager, authClient, logoutUri, popupUtils, popupWindow, e_3, navigationOptions, absoluteUrl, e_4;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -10781,8 +11503,8 @@ var PopupClient = /** @class */ (function (_super) {
                         this.logger.verbose("Popup successfully redirected to postLogoutRedirectUri");
                         return [3 /*break*/, 7];
                     case 6:
-                        e_2 = _a.sent();
-                        this.logger.verbose("Error occurred while monitoring popup for same origin. Session on server may remain active. Error: " + e_2);
+                        e_3 = _a.sent();
+                        this.logger.verbose("Error occurred while monitoring popup for same origin. Session on server may remain active. Error: " + e_3);
                         return [3 /*break*/, 7];
                     case 7:
                         popupUtils.cleanPopup(popupWindow);
@@ -10802,19 +11524,19 @@ var PopupClient = /** @class */ (function (_super) {
                         }
                         return [3 /*break*/, 9];
                     case 8:
-                        e_3 = _a.sent();
+                        e_4 = _a.sent();
                         if (popup) {
                             // Close the synchronous popup if an error is thrown before the window unload event is registered
                             popup.close();
                         }
-                        if (e_3 instanceof AuthError) {
-                            e_3.setCorrelationId(this.correlationId);
+                        if (e_4 instanceof AuthError) {
+                            e_4.setCorrelationId(this.correlationId);
                         }
                         this.browserStorage.setInteractionInProgress(false);
-                        this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_3);
+                        this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_4);
                         this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
-                        serverTelemetryManager.cacheFailedRequest(e_3);
-                        throw e_3;
+                        serverTelemetryManager.cacheFailedRequest(e_4);
+                        throw e_4;
                     case 9:
                         this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
                         return [2 /*return*/];
@@ -10897,7 +11619,7 @@ var RedirectHandler = /** @class */ (function (_super) {
      * Handle authorization code response in the window.
      * @param hash
      */
-    RedirectHandler.prototype.handleCodeResponse = function (locationHash, state, authority, networkModule, clientId) {
+    RedirectHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule, clientId) {
         return __awaiter$1(this, void 0, void 0, function () {
             var stateKey, requestState, authCodeResponse, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
             return __generator$1(this, function (_a) {
@@ -10972,22 +11694,23 @@ var RedirectClient = /** @class */ (function (_super) {
             var validRequest, serverTelemetryManager, authCodeRequest, authClient, interactionHandler, navigateUrl, redirectStartPage, e_1;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        validRequest = this.preflightInteractiveRequest(request, exports.InteractionType.Redirect);
-                        serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenRedirect);
-                        _a.label = 1;
+                    case 0: return [4 /*yield*/, this.preflightInteractiveRequest(request, exports.InteractionType.Redirect)];
                     case 1:
-                        _a.trys.push([1, 6, , 7]);
-                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
+                        validRequest = _a.sent();
+                        serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenRedirect);
+                        _a.label = 2;
                     case 2:
+                        _a.trys.push([2, 7, , 8]);
+                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
+                    case 3:
                         authCodeRequest = _a.sent();
                         return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, validRequest.authority)];
-                    case 3:
+                    case 4:
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
                         interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.browserCrypto);
                         return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
-                    case 4:
+                    case 5:
                         navigateUrl = _a.sent();
                         redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
                         this.logger.verbosePii("Redirect start page: " + redirectStartPage);
@@ -10997,10 +11720,10 @@ var RedirectClient = /** @class */ (function (_super) {
                                 redirectStartPage: redirectStartPage,
                                 onRedirectNavigate: request.onRedirectNavigate
                             })];
-                    case 5: 
+                    case 6: 
                     // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
                     return [2 /*return*/, _a.sent()];
-                    case 6:
+                    case 7:
                         e_1 = _a.sent();
                         if (e_1 instanceof AuthError) {
                             e_1.setCorrelationId(this.correlationId);
@@ -11008,7 +11731,7 @@ var RedirectClient = /** @class */ (function (_super) {
                         serverTelemetryManager.cacheFailedRequest(e_1);
                         this.browserStorage.cleanRequestByState(validRequest.state);
                         throw e_1;
-                    case 7: return [2 /*return*/];
+                    case 8: return [2 /*return*/];
                 }
             });
         });
@@ -11070,7 +11793,7 @@ var RedirectClient = /** @class */ (function (_super) {
                         this.logger.verbose("NavigateToLoginRequestUrl set to false, handling hash");
                         return [2 /*return*/, this.handleHash(responseHash, state, serverTelemetryManager)];
                     case 4:
-                        if (!!BrowserUtils.isInIframe()) return [3 /*break*/, 9];
+                        if (!(!BrowserUtils.isInIframe() || this.config.system.allowRedirectInIframe)) return [3 /*break*/, 9];
                         /*
                          * Returned from authority using redirect - need to perform navigation before processing response
                          * Cache the hash to be retrieved after the next redirect
@@ -11158,7 +11881,7 @@ var RedirectClient = /** @class */ (function (_super) {
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
                         interactionHandler = new RedirectHandler(authClient, this.browserStorage, cachedRequest, this.logger, this.browserCrypto);
-                        return [4 /*yield*/, interactionHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient, this.config.auth.clientId)];
+                        return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient, this.config.auth.clientId)];
                     case 2: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -11418,30 +12141,32 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         this.logger.verbose("acquireTokenByIframe called");
                         // Check that we have some SSO data
                         if (StringUtils.isEmpty(request.loginHint) && StringUtils.isEmpty(request.sid) && (!request.account || StringUtils.isEmpty(request.account.username))) {
-                            throw BrowserAuthError.createSilentSSOInsufficientInfoError();
+                            this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");
                         }
                         // Check that prompt is set to none, throw error if it is set to anything else.
                         if (request.prompt && request.prompt !== PromptValue.NONE) {
                             throw BrowserAuthError.createSilentPromptValueError(request.prompt);
                         }
-                        silentRequest = this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent);
-                        serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                        _a.label = 1;
+                        return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent)];
                     case 1:
-                        _a.trys.push([1, 6, , 7]);
-                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
+                        silentRequest = _a.sent();
+                        serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                        _a.label = 2;
                     case 2:
+                        _a.trys.push([2, 7, , 8]);
+                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
+                    case 3:
                         authCodeRequest = _a.sent();
                         return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, silentRequest.authority)];
-                    case 3:
+                    case 4:
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
                         return [4 /*yield*/, authClient.getAuthCodeUrl(silentRequest)];
-                    case 4:
+                    case 5:
                         navigateUrl = _a.sent();
                         return [4 /*yield*/, this.silentTokenHelper(navigateUrl, authCodeRequest, authClient, this.logger)];
-                    case 5: return [2 /*return*/, _a.sent()];
-                    case 6:
+                    case 6: return [2 /*return*/, _a.sent()];
+                    case 7:
                         e_1 = _a.sent();
                         if (e_1 instanceof AuthError) {
                             e_1.setCorrelationId(this.correlationId);
@@ -11449,7 +12174,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         serverTelemetryManager.cacheFailedRequest(e_1);
                         this.browserStorage.cleanRequestByState(silentRequest.state);
                         throw e_1;
-                    case 7: return [2 /*return*/];
+                    case 8: return [2 /*return*/];
                 }
             });
         });
@@ -11482,7 +12207,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         hash = _a.sent();
                         state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Silent, authCodeRequest.correlationId);
                         // Handle response from hash string
-                        return [2 /*return*/, silentHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient)];
+                        return [2 /*return*/, silentHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                 }
             });
         });
@@ -11505,16 +12230,19 @@ var SilentRefreshClient = /** @class */ (function (_super) {
      */
     SilentRefreshClient.prototype.acquireToken = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var silentRequest, serverTelemetryManager, refreshTokenClient;
+            var silentRequest, _a, serverTelemetryManager, refreshTokenClient;
             var _this = this;
-            return __generator$1(this, function (_a) {
-                switch (_a.label) {
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
                     case 0:
-                        silentRequest = __assign$1(__assign$1({}, request), this.initializeBaseRequest(request));
+                        _a = [__assign$1({}, request)];
+                        return [4 /*yield*/, this.initializeBaseRequest(request)];
+                    case 1:
+                        silentRequest = __assign$1.apply(void 0, _a.concat([_b.sent()]));
                         serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
                         return [4 /*yield*/, this.createRefreshTokenClient(serverTelemetryManager, silentRequest.authority)];
-                    case 1:
-                        refreshTokenClient = _a.sent();
+                    case 2:
+                        refreshTokenClient = _b.sent();
                         this.logger.verbose("Refresh token client created");
                         // Send request to renew token. Auth module will throw errors if token cannot be renewed.
                         return [2 /*return*/, refreshTokenClient.acquireTokenByRefreshToken(silentRequest).catch(function (e) {
@@ -11673,6 +12401,90 @@ var TokenCache = /** @class */ (function () {
     return TokenCache;
 }());
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var HybridSpaAuthorizationCodeClient = /** @class */ (function (_super) {
+    __extends$1(HybridSpaAuthorizationCodeClient, _super);
+    function HybridSpaAuthorizationCodeClient(config) {
+        var _this = _super.call(this, config) || this;
+        _this.includeRedirectUri = false;
+        return _this;
+    }
+    return HybridSpaAuthorizationCodeClient;
+}(AuthorizationCodeClient));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var SilentAuthCodeClient = /** @class */ (function (_super) {
+    __extends$1(SilentAuthCodeClient, _super);
+    function SilentAuthCodeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, correlationId) {
+        var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, correlationId) || this;
+        _this.apiId = apiId;
+        return _this;
+    }
+    /**
+     * Acquires a token silently by redeeming an authorization code against the /token endpoint
+     * @param request
+     */
+    SilentAuthCodeClient.prototype.acquireToken = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var silentRequest, serverTelemetryManager, authCodeRequest, clientConfig, authClient, silentHandler, e_1;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.trace("SilentAuthCodeClient.acquireToken called");
+                        // Auth code payload is required
+                        if (!request.code) {
+                            throw BrowserAuthError.createAuthCodeRequiredError();
+                        }
+                        return [4 /*yield*/, this.initializeAuthorizationRequest(request, exports.InteractionType.Silent)];
+                    case 1:
+                        silentRequest = _a.sent();
+                        serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 4, , 5]);
+                        authCodeRequest = __assign$1(__assign$1({}, silentRequest), { code: request.code });
+                        return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, silentRequest.authority)];
+                    case 3:
+                        clientConfig = _a.sent();
+                        authClient = new HybridSpaAuthorizationCodeClient(clientConfig);
+                        this.logger.verbose("Auth code client created");
+                        silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                        // Handle auth code parameters from request
+                        return [2 /*return*/, silentHandler.handleCodeResponseFromServer({
+                                code: request.code,
+                                msgraph_host: request.msGraphHost,
+                                cloud_graph_host_name: request.cloudGraphHostName,
+                                cloud_instance_host_name: request.cloudInstanceHostName
+                            }, silentRequest.state, authClient.authority, this.networkClient, false)];
+                    case 4:
+                        e_1 = _a.sent();
+                        if (e_1 instanceof AuthError) {
+                            e_1.setCorrelationId(this.correlationId);
+                        }
+                        serverTelemetryManager.cacheFailedRequest(e_1);
+                        this.browserStorage.cleanRequestByState(silentRequest.state);
+                        throw e_1;
+                    case 5: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Currently Unsupported
+     */
+    SilentAuthCodeClient.prototype.logout = function () {
+        // Synchronous so we must reject
+        return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
+    };
+    return SilentAuthCodeClient;
+}(StandardInteractionClient));
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -11716,8 +12528,10 @@ var ClientApplication = /** @class */ (function () {
         this.navigationClient = this.config.system.navigationClient;
         // Initialize redirectResponse Map
         this.redirectResponse = new Map();
+        // Initial hybrid spa map
+        this.hybridAuthCodeResponses = new Map();
         // Initialize the crypto class.
-        this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps() : DEFAULT_CRYPTO_IMPLEMENTATION;
+        this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger) : DEFAULT_CRYPTO_IMPLEMENTATION;
         this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
         // Initialize the browser storage class.
         this.browserStorage = this.isBrowserEnvironment ?
@@ -11920,6 +12734,77 @@ var ClientApplication = /** @class */ (function () {
             });
         });
     };
+    /**
+     * This function redeems an authorization code (passed as code) from the eSTS token endpoint.
+     * This authorization code should be acquired server-side using a confidential client to acquire a spa_code.
+     * This API is not indended for normal authorization code acquisition and redemption.
+     *
+     * Redemption of this authorization code will not require PKCE, as it was acquired by a confidential client.
+     *
+     * @param request {@link AuthorizationCodeRequest}
+     * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
+     */
+    ClientApplication.prototype.acquireTokenByCode = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var response;
+            var _this = this;
+            return __generator$1(this, function (_a) {
+                this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
+                this.logger.trace("acquireTokenByCode called", request.correlationId);
+                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
+                try {
+                    if (!request.code) {
+                        throw BrowserAuthError.createAuthCodeRequiredError();
+                    }
+                    response = this.hybridAuthCodeResponses.get(request.code);
+                    if (!response) {
+                        this.logger.verbose("Initiating new acquireTokenByCode request", request.correlationId);
+                        response = this.acquireTokenByCodeAsync(request)
+                            .then(function (result) {
+                            _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
+                            _this.hybridAuthCodeResponses.delete(request.code);
+                            return result;
+                        })
+                            .catch(function (error) {
+                            _this.hybridAuthCodeResponses.delete(request.code);
+                            throw error;
+                        });
+                        this.hybridAuthCodeResponses.set(request.code, response);
+                    }
+                    else {
+                        this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
+                    }
+                    return [2 /*return*/, response];
+                }
+                catch (e) {
+                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
+                    throw e;
+                }
+                return [2 /*return*/];
+            });
+        });
+    };
+    /**
+     * Creates a SilentAuthCodeClient to redeem an authorization code.
+     * @param request
+     * @returns Result of the operation to redeem the authorization code
+     */
+    ClientApplication.prototype.acquireTokenByCodeAsync = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var silentAuthCodeClient, silentTokenResult;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.trace("acquireTokenByCodeAsync called", request.correlationId);
+                        silentAuthCodeClient = new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenByCode, request.correlationId);
+                        return [4 /*yield*/, silentAuthCodeClient.acquireToken(request)];
+                    case 1:
+                        silentTokenResult = _a.sent();
+                        return [2 /*return*/, silentTokenResult];
+                }
+            });
+        });
+    };
     /**
      * Use this function to obtain a token before every call to the API / resource provider
      *
@@ -11946,7 +12831,7 @@ var ClientApplication = /** @class */ (function () {
                         var isInvalidGrantError = (e.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
                         if (isServerError && isInvalidGrantError && !isInteractionRequiredError) {
                             _this.logger.verbose("Refresh token expired or invalid, attempting acquire token by iframe", request.correlationId);
-                            var silentIframeClient = new SilentIframeClient(_this.config, _this.browserStorage, _this.browserCrypto, _this.logger, _this.eventHandler, _this.navigationClient, exports.ApiId.acquireTokenSilent_authCode);
+                            var silentIframeClient = new SilentIframeClient(_this.config, _this.browserStorage, _this.browserCrypto, _this.logger, _this.eventHandler, _this.navigationClient, exports.ApiId.acquireTokenSilent_authCode, request.correlationId);
                             return silentIframeClient.acquireToken(request);
                         }
                         throw e;
@@ -12119,6 +13004,18 @@ var ClientApplication = /** @class */ (function () {
     ClientApplication.prototype.removeEventCallback = function (callbackId) {
         this.eventHandler.removeEventCallback(callbackId);
     };
+    /**
+     * Adds event listener that emits an event when a user account is added or removed from localstorage in a different browser tab or window
+     */
+    ClientApplication.prototype.enableAccountStorageEvents = function () {
+        this.eventHandler.enableAccountStorageEvents();
+    };
+    /**
+     * Removes event listener that emits an event when a user account is added or removed from localstorage in a different browser tab or window
+     */
+    ClientApplication.prototype.disableAccountStorageEvents = function () {
+        this.eventHandler.disableAccountStorageEvents();
+    };
     /**
      * Gets the token cache for the application.
      */
@@ -12154,6 +13051,12 @@ var ClientApplication = /** @class */ (function () {
     ClientApplication.prototype.setNavigationClient = function (navigationClient) {
         this.navigationClient = navigationClient;
     };
+    /**
+     * Returns the configuration object
+     */
+    ClientApplication.prototype.getConfiguration = function () {
+        return this.config;
+    };
     return ClientApplication;
 }());
 
@@ -12226,7 +13129,17 @@ var SilentCacheClient = /** @class */ (function (_super) {
         });
     };
     SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
-        return __assign$1(__assign$1(__assign$1({}, request), this.initializeBaseRequest(request)), { account: account, forceRefresh: request.forceRefresh || false });
+        return __awaiter$1(this, void 0, void 0, function () {
+            var _a;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _a = [__assign$1({}, request)];
+                        return [4 /*yield*/, this.initializeBaseRequest(request)];
+                    case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
+                }
+            });
+        });
     };
     return SilentCacheClient;
 }(StandardInteractionClient));
@@ -12317,10 +13230,12 @@ var PublicClientApplication = /** @class */ (function (_super) {
                     authority: request.authority || "",
                     scopes: request.scopes,
                     homeAccountIdentifier: account.homeAccountId,
+                    claims: request.claims,
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
-                    shrClaims: request.shrClaims
+                    shrClaims: request.shrClaims,
+                    sshKid: request.sshKid
                 };
                 silentRequestKey = JSON.stringify(thumbprint);
                 cachedResponse = this.activeSilentTokenRequests.get(silentRequestKey);
@@ -12356,28 +13271,33 @@ var PublicClientApplication = /** @class */ (function (_super) {
             var silentCacheClient, silentRequest;
             var _this = this;
             return __generator$1(this, function (_a) {
-                silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient);
-                silentRequest = silentCacheClient.initializeSilentRequest(request, account);
-                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
-                return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                        var tokenRenewalResult, tokenRenewalError_1;
-                        return __generator$1(this, function (_a) {
-                            switch (_a.label) {
-                                case 0:
-                                    _a.trys.push([0, 2, , 3]);
-                                    return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
-                                case 1:
-                                    tokenRenewalResult = _a.sent();
-                                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
-                                    return [2 /*return*/, tokenRenewalResult];
-                                case 2:
-                                    tokenRenewalError_1 = _a.sent();
-                                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
-                                    throw tokenRenewalError_1;
-                                case 3: return [2 /*return*/];
-                            }
-                        });
-                    }); })];
+                switch (_a.label) {
+                    case 0:
+                        silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, request.correlationId);
+                        return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
+                    case 1:
+                        silentRequest = _a.sent();
+                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
+                        return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
+                                var tokenRenewalResult, tokenRenewalError_1;
+                                return __generator$1(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0:
+                                            _a.trys.push([0, 2, , 3]);
+                                            return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
+                                        case 1:
+                                            tokenRenewalResult = _a.sent();
+                                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
+                                            return [2 /*return*/, tokenRenewalResult];
+                                        case 2:
+                                            tokenRenewalError_1 = _a.sent();
+                                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
+                                            throw tokenRenewalError_1;
+                                        case 3: return [2 /*return*/];
+                                    }
+                                });
+                            }); })];
+                }
             });
         });
     };
@@ -12398,6 +13318,9 @@ var stubbedPublicClientApplication = {
     acquireTokenSilent: function () {
         return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
     },
+    acquireTokenByCode: function () {
+        return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
+    },
     getAllAccounts: function () {
         return [];
     },
@@ -12437,6 +13360,12 @@ var stubbedPublicClientApplication = {
     removeEventCallback: function () {
         return;
     },
+    enableAccountStorageEvents: function () {
+        return;
+    },
+    disableAccountStorageEvents: function () {
+        return;
+    },
     getTokenCache: function () {
         throw BrowserConfigurationAuthError.createStubPcaInstanceCalledError();
     },
@@ -12457,6 +13386,9 @@ var stubbedPublicClientApplication = {
     },
     setNavigationClient: function () {
         return;
+    },
+    getConfiguration: function () {
+        throw BrowserConfigurationAuthError.createStubPcaInstanceCalledError();
     }
 };
 
@@ -12529,8 +13461,10 @@ var EventMessageUtils = /** @class */ (function () {
  * Licensed under the MIT License.
  */
 var SignedHttpRequest = /** @class */ (function () {
-    function SignedHttpRequest(shrParameters) {
-        this.cryptoOps = new CryptoOps();
+    function SignedHttpRequest(shrParameters, shrOptions) {
+        var loggerOptions = (shrOptions && shrOptions.loggerOptions) || {};
+        this.logger = new Logger(loggerOptions, name, version);
+        this.cryptoOps = new CryptoOps(this.logger);
         this.popTokenGenerator = new PopTokenGenerator(this.cryptoOps);
         this.shrParameters = shrParameters;
     }
@@ -12573,7 +13507,10 @@ var SignedHttpRequest = /** @class */ (function () {
     SignedHttpRequest.prototype.removeKeys = function (publicKeyThumbprint) {
         return __awaiter$1(this, void 0, void 0, function () {
             return __generator$1(this, function (_a) {
-                return [2 /*return*/, this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint)];
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint)];
+                    case 1: return [2 /*return*/, _a.sent()];
+                }
             });
         });
     };
@@ -12583,18 +13520,26 @@ var SignedHttpRequest = /** @class */ (function () {
 exports.AccountEntity = AccountEntity;
 exports.AuthError = AuthError;
 exports.AuthErrorMessage = AuthErrorMessage;
+exports.AuthenticationHeaderParser = AuthenticationHeaderParser;
 exports.BrowserAuthError = BrowserAuthError;
 exports.BrowserAuthErrorMessage = BrowserAuthErrorMessage;
 exports.BrowserConfigurationAuthError = BrowserConfigurationAuthError;
 exports.BrowserConfigurationAuthErrorMessage = BrowserConfigurationAuthErrorMessage;
 exports.BrowserUtils = BrowserUtils;
+exports.ClientAuthError = ClientAuthError;
+exports.ClientAuthErrorMessage = ClientAuthErrorMessage;
+exports.ClientConfigurationError = ClientConfigurationError;
+exports.ClientConfigurationErrorMessage = ClientConfigurationErrorMessage;
 exports.EventMessageUtils = EventMessageUtils;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
+exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
 exports.Logger = Logger;
 exports.NavigationClient = NavigationClient;
 exports.PublicClientApplication = PublicClientApplication;
+exports.ServerError = ServerError;
 exports.SignedHttpRequest = SignedHttpRequest;
 exports.StringUtils = StringUtils;
 exports.UrlString = UrlString;
 exports.stubbedPublicClientApplication = stubbedPublicClientApplication;
+exports.version = version;
 //# sourceMappingURL=index.cjs.js.map